PT-2008-5539 · Microsoft · Visual Studio .Net+3

Brett Moore + 2 · Publicado 2008-12-10 · Atualizado 2018-10-12 · CVE-2008-4255

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1

Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user.

Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.

Exploit

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-4255

Produtos afetados

Visual Basic 6.0

Office Project

Visual Foxpro

Visual Studio .Net

Referências · 15

• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl · Exploit
• 🔥 https://exploit-db.com/exploits/7431 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4255 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-070 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4255 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6032 · Nota
• http://zerodayinitiative.com/advisories/ZDI-08-083 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/3382 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4255 · Nota de Segurança
• http://securityfocus.com/archive/1/499061/100/0/threaded · Nota
• http://securitytracker.com/id?1021369 · Nota
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm · Nota
• http://securityfocus.com/bid/32613 · Correção