Description
Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyISUpload.cab 1.0.0.38 for Sony ImageStation allows remote attackers to execute arbitrary code via a long argument to the SetLogging method. NOTE: some of these details are obtained from third party information.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- ImageStation - 'SonyISUpload.cab' 1.0.0.38 ActiveX Buffer Overflow EDB-5100 · remote · Feb 10, 2008 · verified
- ImageStation - 'SonyISUpload.cab 1.0.0.38' ActiveX Buffer Overflow (PoC) EDB-5086 · dos · Feb 8, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20080208 Buffer Overflow Vulnerability in AxRUploadServer.dll, Activex Method (SetLogging) mailing-list
- 3648 third-party-advisory
- 5086 exploit
- 28854 third-party-advisory
- 5100 exploit
- 27715 vdb-entry
- ADV-2008-0483 vdb-entry
- 20080208 Re: Buffer Overflow Vulnerability in AxRUploadServer.dll, Activex Method (SetLogging) mailing-list