Will Dormann has reported some vulnerabilities in Media Technology Group CDPass ActiveX Control, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the Media Technology Group CDPass (CDPass.dll) ActiveX control when handling certain methods or properties (e.g. "GetTOC2()"). These can be exploited to cause stack-based buffer overflows when e.g. a user visits a malicious website.

Successful exploitation allows execution of arbitrary code.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Will Dormann, CERT/CC

Changelog
Further details available to Secunia VIM customers

Original Advisory
US-CERT VU#933353:
http://www.kb.cert.org/vuls/id/933353

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers