PT-2007-3907 · Microsoft · Office Viewer Ocx Activex Control

Publicado 2007-05-09 · Atualizado 2017-07-29 · CVE-2007-2588

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Office Viewer OCX ActiveX control (oa.ocx) version 3.2

Description The issue is related to multiple buffer overflows in the Office Viewer OCX ActiveX control. This can be exploited by remote attackers who send a long argument to certain functions, potentially causing a denial of service or possibly allowing the execution of arbitrary code. The affected functions include HttpDownloadFile(), Open(), OpenWebFile(), DoOleCommand(), FTPDownloadFile(), FTPUploadFile(), HttpUploadFile(), Save(), and SaveWebFile().

Recommendations For Office Viewer OCX ActiveX control (oa.ocx) version 3.2, consider disabling the affected functions until a patch is available. Restrict access to the oa.ocx control to minimize the risk of exploitation. Avoid using long arguments in the affected functions to prevent potential buffer overflows.

Exploit

Correção

Identificadores relacionados

CVE-2007-2588

Produtos afetados

Office Viewer Ocx Activex Control

Referências · 9

• 🔥 http://securityfocus.com/bid/23811 · Exploit
• 🔥 https://exploit-db.com/exploits/3845 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2588 · Nota de Segurança
• http://secunia.com/advisories/25143 · Aviso do Fabricante
• http://osvdb.org/34335 · Nota
• http://shinnai.altervista.org/moaxb/20070504/oa.txt · Nota
• http://moaxb.blogspot.com/2007/05/moaxb-04-office-viewer-oaocx-v-32.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34067 · Nota
• http://vupen.com/english/advisories/2007/1664 · Nota