Multiple vulnerabilities have been reported in BB FlashBack SDK, which can be exploited by malicious people to compromise a user's system.

1) The insecure "Start()", "PauseAndSave()", "InsertMarker()", "InsertSoundToFBRAtMarker()", and "TestCompatibilityRecordMode()" methods within the BB FlashBack Recorder ActiveX control (BB FlashBack Recorder.dll) can be exploited to execute arbitrary code via directory traversal and script injection by tricking a user into visiting a malicious website.

2) An error in the "InsertMarker()" and "TestCompatibilityRecordMode()" methods within the BB FLashBack Recorder ActiveX control (BB FlashBack Recorder.dll) can be exploited to cause a memory corruption via uninitialised pointers by tricking a user into visiting a malicious website.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 2.0.0.214.

Solution
Update to version 2.0.0.214.
Further details available to Secunia VIM customers

Provided and/or discovered by
Originally reported in IBM Rational Rhapsody by Andrea Micalizzi via ZDI.

Changelog
Further details available to Secunia VIM customers

Original Advisory
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21576352

ZDI-12-028:
http://www.zerodayinitiative.com/advisories/ZDI-12-028/

ZDI-12-029:
http://www.zerodayinitiative.com/advisories/ZDI-12-029/

ZDI-12-030:
http://www.zerodayinitiative.com/advisories/ZDI-12-030/

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers