PT-2007-3973 · Hewlett Packard · Magview Activex Control

Callax · Publicado 2007-05-14 · Atualizado 2017-10-11 · CVE-2007-2656

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Hewlett-Packard (HP) Magview ActiveX control version 1.0.0.309

Description The issue is related to a stack-based buffer overflow in the Hewlett-Packard (HP) Magview ActiveX control, which can be triggered by passing a long argument to the DeleteProfile method. This can cause a denial of service, resulting in an application crash, and potentially have other impacts.

Recommendations For version 1.0.0.309, consider disabling the DeleteProfile method as a temporary workaround until a patch is available. Restrict access to the hpqvwocx.dll module to minimize the risk of exploitation. Avoid using the DeleteProfile method with long arguments in the affected ActiveX control until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-2656

Produtos afetados

Magview Activex Control

Referências · 5

• 🔥 http://securityfocus.com/bid/23941 · Exploit
• 🔥 https://exploit-db.com/exploits/3898 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2656 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34239 · Nota
• http://osvdb.org/37787 · Nota