PT-2007-3820 · Microsoft · Internet Explorer

Shinnai · Publicado 2007-05-04 · Atualizado 2017-07-29 · CVE-2007-2496

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions WordViewer.ocx version 3.2.0.5

Description The issue allows remote attackers to cause a denial of service, specifically an Internet Explorer 7 crash, by exploiting the WordOCX ActiveX control in WordViewer.ocx. This can be achieved through a long value in various properties, including DoOleCommand, FTPDownloadFile, FTPUploadFile, HttpUploadFile, GotoPage, Save, SaveWebFile, HttpDownloadFile, Open, OpenWebFile, SaveAs, or ShowWordStandardDialog.

Recommendations For WordViewer.ocx version 3.2.0.5, consider restricting the use of the WordOCX ActiveX control to minimize the risk of exploitation. As a temporary workaround, avoid using long property values in the affected properties until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-2496

Produtos afetados

Internet Explorer

Referências · 8

• 🔥 https://exploit-db.com/exploits/3836 · Exploit
• http://moaxb.blogspot.com/2007/05/moaxb-03-wordviewerocx-32-multiple_03.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2496 · Nota de Segurança
• http://osvdb.org/34334 · Nota
• http://secunia.com/advisories/25100 · Nota
• http://vupen.com/english/advisories/2007/1634 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34027 · Nota
• http://securityfocus.com/bid/23784 · Nota