PT-2007-3555 · Microsoft · Tblinf32.Dll+2

Publicado 2007-08-14 · Atualizado 2021-07-23 · CVE-2007-2216

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 5.01, 6 SP1, and 7

Description The issue allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function. This is due to an incorrect IObjectsafety implementation in the tblinf32.dll (also known as vstlbinf.dll) ActiveX control. An attacker could exploit this by constructing a specially crafted Web page, potentially allowing remote code execution if a user visits the page, and could gain the same user rights as the logged-on user.

Recommendations For Internet Explorer versions 5.01, 6 SP1, and 7, consider disabling the tblinf32.dll (aka vstlbinf.dll) ActiveX control to prevent exploitation until a patch is available. As a temporary workaround, restrict access to Web pages that could potentially exploit this issue to minimize the risk of remote code execution.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2007-2216

Produtos afetados

Internet Explorer

Tblinf32.Dll

Vstlbinf.Dll

Referências · 12

• 🔥 https://exploit-db.com/exploits/30490 · Exploit
• http://vupen.com/english/advisories/2007/2869 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2216 · Nota de Segurança
• http://securityfocus.com/bid/25289 · Correção
• http://securityfocus.com/archive/1/476742/100/0/threaded · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2109 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-045 · Aviso do Fabricante
• http://securitytracker.com/id?1018562 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2216 · Nota de Segurança
• http://secunia.com/advisories/26419 · Aviso do Fabricante
• http://osvdb.org/36396 · Nota
• http://us-cert.gov/cas/techalerts/TA07-226A.html · Nota