PT-2008-5064 · Microsoft · Msmask32.Ocx

Koshi · Publicado 2008-08-18 · Atualizado 2018-10-12 · CVE-2008-3704

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Msmask32.ocx version 6.0.81.69 Msmask32.ocx versions prior to 6.0.84.18

Description The issue is related to a heap-based buffer overflow in the MaskedEdit ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long Mask parameter, due to the lack of boundary checks when validating property values. The issue has been exploited in the wild.

Recommendations For Msmask32.ocx version 6.0.81.69, update to version 6.0.84.18 or later. For Msmask32.ocx versions prior to 6.0.84.18, update to version 6.0.84.18 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-3704

Produtos afetados

Msmask32.Ocx

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms08_070_visual_studio_msmask.rb · Exploit
• 🔥 http://securityfocus.com/bid/30674 · Exploit
• 🔥 https://exploit-db.com/exploits/6317 · Exploit
• 🔥 https://exploit-db.com/exploits/16507 · Exploit
• 🔥 https://exploit-db.com/exploits/6244 · Exploit
• http://vupen.com/english/advisories/2008/2380 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/3382 · Aviso do Fabricante
• http://securitytracker.com/id?1020710 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5794 · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm · Nota
• http://secunia.com/advisories/31498 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3704 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44444 · Nota
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Nota