PT-2007-1521 · Microsoft · Mfc42U.Dll+2

Published 2007-02-13 · Updated 2018-10-12 · CVE-2007-0025

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fix Visual Studio .NET versions prior to the fix

Description The issue allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. This might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.

Recommendations For Microsoft Windows, apply the fix to resolve the issue. For Visual Studio .NET, apply the fix to resolve the issue. As a temporary workaround, consider avoiding the use of RTF files with malformed OLE objects until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-0025

Affected Products

Mfc42U.Dll

Visual Studio .Net

Windows

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-0025 · Security Note
• http://vupen.com/english/advisories/2007/0581 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-012 · Vendor Advisory
• http://secunia.com/advisories/24150 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA07-044A.html · Note
• http://securitytracker.com/id?1017638 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157 · Note
• http://kb.cert.org/vuls/id/932041 · Note
• http://osvdb.org/31887 · Note
• http://securityfocus.com/bid/22476 · Note