PT-2007-1521 · Microsoft · Mfc42U.Dll+2

Publicado 2007-02-13 · Atualizado 2018-10-12 · CVE-2007-0025

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fix Visual Studio .NET versions prior to the fix

Description The issue allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. This might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.

Recommendations For Microsoft Windows, apply the fix to resolve the issue. For Visual Studio .NET, apply the fix to resolve the issue. As a temporary workaround, consider avoiding the use of RTF files with malformed OLE objects until a patch is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-0025

Produtos afetados

Mfc42U.Dll

Visual Studio .Net

Windows

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-0025 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA07-044A.html · Nota
• http://vupen.com/english/advisories/2007/0581 · Aviso do Fabricante
• http://securitytracker.com/id?1017638 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157 · Nota
• http://kb.cert.org/vuls/id/932041 · Nota
• http://osvdb.org/31887 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-012 · Aviso do Fabricante
• http://securityfocus.com/bid/22476 · Nota
• http://secunia.com/advisories/24150 · Aviso do Fabricante