PT-2007-2285 · Microsoft · Visual C++ 8.0 Standard Library

3Apa3A · Published 2007-02-13 · Updated 2024-03-12 · CVE-2007-0842

Positive Technologies · (AI Summary)

CVSS v2.0

5.0

Medium

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) version 8.0

Description: The 64-bit versions of Microsoft Visual C++ 8.0 standard library time functions, including localtime, localtime s, gmtime, gmtime s, ctime, ctime s, wctime, wctime s, and fstat, trigger an assertion error instead of a NULL pointer or EINVAL when processing a time argument later than Jan 1, 3000. This might allow context-dependent attackers to cause a denial of service via large time values. The behavior is inconsistent with documentation, which does not list assertions as a possible result of an error condition.

Recommendations: For Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) version 8.0, consider validating arguments to the time functions to prevent assertion errors and potential denial of service attacks. As a temporary workaround, consider adding input validation to ensure time values do not exceed Jan 1, 3000, until a more comprehensive solution is available.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-0842

Affected Products

Visual C++ 8.0 Standard Library

References · 7

• 🔥 http://securityreason.com/securityalert/2237 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0842 · Security Note
• http://msdn2.microsoft.com/en-us/library/a442x3ye%28VS.80%29.aspx · Vendor Advisory
• https://t.me/cvenotify/73615 · Telegram Post
• http://securityfocus.com/archive/1/459847/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32454 · Note
• http://osvdb.org/33626 · Note