Secunia

Krystian Kloskowski has discovered a vulnerability in jetAudio, which can be exploited by malicious people to overwrite arbitrary files or to compromise a user's system.

The vulnerability is caused due to the JetAudio.Interface.1 ActiveX control (JetFlExt.dll) including the insecure "DownloadFromMusicStore()" method, which downloads a file from a server into an arbitrary location on the system via directory traversal attacks. This can be exploited to e.g. download an arbitrary file and overwrite the JetAudio.exe application, which gets executed after the download is completed.

The vulnerability is confirmed in version 7.0.3.3016. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Krystian Kloskowski

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/4427

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area