PT-2007-1148 · Microsoft · Biztalk Server 2004+1

Published 2007-05-08 · Updated 2018-10-16 · CVE-2007-0940

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2

Description: The issue is related to an unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control, which can allow remote attackers to execute arbitrary code. This vulnerability is associated with errors in code generation management. The exploitation of this issue may enable a remote attacker to execute arbitrary code.

Recommendations: For Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2019-01970

CVE-2007-0940

Affected Products

Biztalk Server 2004

Capicom

References · 17

• https://bdu.fstec.ru/vul/2019-01970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-0940 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-028 · Vendor Advisory
• http://securityfocus.com/archive/1/468871/100/200/threaded · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32739 · Note
• https://web-material3.yokogawa.com/1/23443/files/YSAR-19-0002-E.pdf?_ga=2.267909774.1818437446.1557984119-911428449.1549288055 · Note
• https://tools.cisco.com/security/center/viewAlert.x?alertId=13288 · Note
• http://vupen.com/english/advisories/2007/1713 · Note
• http://secunia.com/advisories/25185 · Note
• http://securitytracker.com/id?1018016 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1670 · Note
• http://securityfocus.com/bid/23782 · Note
• http://kb.cert.org/vuls/id/866305 · Note
• http://osvdb.org/34397 · Note
• https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2007/ms07-028 · Note