PT-2007-3561 · Microsoft · Msxml+1
Publicado
2007-08-14
·
Atualizado
2019-02-27
·
CVE-2007-2223
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft XML Core Services (MSXML) versions 3.0 through 6.0
Description
A remote code execution issue exists, allowing attackers to execute arbitrary code via the
substringData method on a TextNode or XMLDOM object, leading to an integer overflow and buffer overflow. This could enable an attacker to make changes to the system with the permissions of the logged-on user. If the user has administrative rights, the attacker could gain complete control of the system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.Recommendations
For Microsoft XML Core Services (MSXML) versions 3.0 through 6.0, update to a version outside of this range to resolve the issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Integer Overflow
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Msxml
Office