Some vulnerabilities have been discovered in Nero, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to certain bundled applications loading various libraries in an insecure manner and also including vulnerable versions of mfc71.dll and mfc71u.dll, which load libraries (e.g. mfc71enu.dll, mfc71loc.dll) in an insecure manner. This can be exploited to load arbitrary libraries by tricking a user into e.g. opening a Quicktime Movie (.mov), Windows Bitmap Image (.bmp), Nero CD Cover Document (.cdc), CUE Image (.cue), Nero BackItUp Archive (.nba), or Nero SoundTrax Project (.npf) located on a remote WebDAV or SMB share.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities are confirmed in the following products bundled with Nero 7.11.10.0 Premium:
* Nero ShowTime 3.10.1.0
* Nero PhotoSnap 1.2.0.25
* Nero PhotoSnap Viewer 1.2.0.25
* Nero CoverDesigner 2.10.1.1
* Nero Burning ROM 7.11.10.0
* Nero BackItUp 2.10.6.4
* Nero Vision 4.9.7.6
* Nero SoundTrax 2.10.1.0

Solution
Do not open untrusted files.

Provided and/or discovered by
Mister Teatime

Additional information provided by Secunia Research.

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers