PT-2007-3818 · Microsoft · Powerpointviewer.Ocx+1

Shinnai · Publicado 2007-05-04 · Atualizado 2017-10-11 · CVE-2007-2494

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PowerPointViewer.ocx version 3.1.0.3

Description The issue is related to multiple stack-based buffer overflows in the PowerPointOCX ActiveX control. This can be exploited by remote attackers to cause a denial of service, specifically crashing Internet Explorer 7, by providing a long value for certain properties, including DoOleCommand, FTPDownloadFile, FTPUploadFile, HttpUploadFile, Save, SaveWebFile, HttpDownloadFile, Open, or OpenWebFile.

Recommendations For PowerPointViewer.ocx version 3.1.0.3, consider disabling the ActiveX control until a patch is available to prevent potential crashes of Internet Explorer 7. Restrict access to the properties that can cause the buffer overflows, such as limiting the length of input for DoOleCommand, FTPDownloadFile, FTPUploadFile, HttpUploadFile, Save, SaveWebFile, HttpDownloadFile, Open, or OpenWebFile, to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-2494

Produtos afetados

Internet Explorer 7

Powerpointviewer.Ocx

Referências · 8

• 🔥 https://exploit-db.com/exploits/3826 · Exploit
• http://moaxb.blogspot.com/2007/05/moaxb-01-powerpointviewerocx-31.html · Nota
• http://secunia.com/advisories/25092 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1612 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2494 · Nota de Segurança
• http://securityfocus.com/bid/23733 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34013 · Nota
• http://osvdb.org/34332 · Nota