PT-2007-2902 · Microsoft · Mfc+2

Published 2007-03-20 · Updated 2018-10-16 · CVE-2007-1512

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patch for the issue Visual Studio .NET versions prior to the patch for the issue

Description The issue is a stack-based buffer overflow in the MFC component, specifically in the AfxOleSetEditMenu function. This allows user-assisted remote attackers to potentially crash the system via an RTF file with a malformed OLE object. The attack results in writing two 0x00 characters past the end of szBuffer.

Recommendations For Microsoft Windows, apply the patch that fixes the issue. For Visual Studio .NET, apply the patch that fixes the issue. As a temporary workaround, consider avoiding the use of RTF files with malformed OLE objects until a patch is available.

Fix

Related Identifiers

CVE-2007-1512

Affected Products

Mfc

Windows

Visual Studio .Net

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2007-1512 · Security Note
• http://securityfocus.com/archive/1/463009/100/0/threaded · Note