Will Dormann has discovered some vulnerabilities in NCTAudioStudio and NCTAudioEditor, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors in the NCTAudioInformation2 (NCTAudioInformation2.dll) ActiveX control when handling certain properties or methods (e.g. "GetAudioInformation()" and "SetAudioInformation()"). These can be exploited to cause stack-based buffer overflows when a user is tricked into visiting a malicious website.

Successful exploitation allows execution of arbitrary code.

Some vulnerabilities are confirmed in NCTAudioInformation2.dll versions 2.1.2.0 and 2.2.4.0. Other versions may also be affected.

Solution
Update to version 2.5.9.252 or later of the ActiveX control.
Further details available to Secunia VIM customers

Provided and/or discovered by
Will Dormann, CERT/CC.

Additional information provided by Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
US-CERT VU#669265:
http://www.kb.cert.org/vuls/id/669265

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers