PT-2007-1933 · Microsoft · Visual Studio

Published 2007-01-24 · Updated 2018-10-16 · CVE-2007-0468

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio 6.0 SP6

Description The issue is related to a stack-based buffer overflow in the rcdll.dll component of msdev.exe in Microsoft Visual Studio. This occurs when a long file path is used in the "1 TYPELIB MOVEABLE PURE" option within an RC file, potentially allowing remote attackers to execute arbitrary code with user assistance.

Recommendations For Microsoft Visual Studio 6.0 SP6, consider avoiding the use of long file paths in the "1 TYPELIB MOVEABLE PURE" option in RC files until a fix is available. As a temporary workaround, restrict the handling of RC files with potentially long paths to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0468

Affected Products

Visual Studio

References · 8

• 🔥 http://secunia.com/advisories/23856 · Exploit
• 🔥 http://anspi.pl/~porkythepig/visualization/rc-kupiekrowe.cpp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0468 · Security Note
• http://vupen.com/english/advisories/2007/0296 · Note
• http://osvdb.org/31607 · Note
• http://securityfocus.com/archive/1/457646/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31665 · Note
• http://securityreason.com/securityalert/2172 · Note