PT-2007-3113 · Microsoft · Windows+1

Ben Nagy + 1 · Published 2007-08-14 · Updated 2021-07-23 · CVE-2007-1749

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 7

Description: The issue is related to an integer underflow in the CDownloadSink class code within the Vector Markup Language (VML) component. This allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, triggering a heap-based buffer overflow. A remote code execution vulnerability exists in the VML implementation in Microsoft Windows, which could be exploited by constructing a specially crafted Web page or HTML e-mail, allowing remote code execution when a user views the Web page or the message.

Recommendations: For Internet Explorer versions 5.01 through 7, consider disabling the VML component until a patch is available. Restrict access to specially crafted Web pages or HTML e-mails to minimize the risk of exploitation. Avoid using compressed content with invalid buffer sizes in the affected VML implementation until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-1749

Affected Products

Internet Explorer

Windows

References · 15

• 🔥 https://exploit-db.com/exploits/30494 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1749 · Security Note
• http://securityfocus.com/bid/25310 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1749 · Security Note
• http://secunia.com/advisories/26409 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-050 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1784 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-050 · Note
• http://research.eeye.com/html/advisories/published/AD20070814a.html · Note
• http://securitytracker.com/id?1018568 · Note
• http://securityfocus.com/archive/1/476498/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/2874 · Note
• http://securityreason.com/securityalert/3020 · Note
• http://kb.cert.org/vuls/id/468800 · Note
• http://us-cert.gov/cas/techalerts/TA07-226A.html · Note