PT-2007-6004 · Microsoft · Visual Studio

Shinnai · Publicado 2007-09-14 · Atualizado 2017-09-29 · CVE-2007-4890

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio 6.0

Description: The issue allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveAs method. It is also possible to copy contents from local files via the Load method.

Recommendations: For Microsoft Visual Studio 6.0, consider restricting access to the SaveAs method and the Load method in the VB To VSI Support Library until a fix is available. As a temporary workaround, avoid using the SaveAs method with full pathnames and be cautious when using the Load method to prevent copying contents from unauthorized local files.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-4890

Produtos afetados

Visual Studio

Referências · 6

• 🔥 https://exploit-db.com/exploits/4394 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36571 · Nota
• http://securityfocus.com/bid/25635 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4890 · Nota de Segurança
• http://shinnai.altervista.org/exploits/txt/TXT_qwFZc3a35RLy5AGxVBjJ.html · Nota
• http://secunia.com/advisories/26779 · Nota