PT-2012-4029 · Microsoft+1 · Internet Explorer+1

Derek Soeder · Publicado 2012-04-25 · Atualizado 2021-07-23 · CVE-2012-2418

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:A/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intuit QuickBooks versions 2009 through 2012

Description The issue is related to a heap-based buffer overflow in the intu-help-qb handlers in HelpAsyncPluggableProtocol.dll. This occurs when Internet Explorer is used and a URI with a % (percent) character as its last or second-to-last character is accessed. The result can be a denial of service due to memory corruption or possibly the execution of arbitrary code.

Recommendations For Intuit QuickBooks versions 2009 through 2012, consider avoiding the use of Internet Explorer or restricting access to URIs that contain a % (percent) character as their last or second-to-last character until a fix is available. As a temporary workaround, disabling the intu-help-qb handlers in HelpAsyncPluggableProtocol.dll may help minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-2418

Produtos afetados

Internet Explorer

Intuit Quickbooks

Referências · 5

• 🔥 http://securityfocus.com/archive/1/522138 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75170 · Nota
• http://kb.cert.org/vuls/id/232979 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2418 · Nota de Segurança
• http://osvdb.org/80820 · Nota