PT-2007-3558 · Microsoft · Windows+1

Published 2007-06-12 · Updated 2018-10-16 · CVE-2007-2219

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue allows remote attackers to execute arbitrary code via certain parameters to an unspecified function in the Win32 API. A remote code execution vulnerability exists in the way that the Win32 API validates parameters. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could potentially allow remote code execution if a user viewed the Web page. This could allow an attacker to take complete control of an affected system.

Recommendations For Microsoft Windows 2000, XP SP2, and Server 2003 SP1 and SP2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2219

Affected Products

Windows

Win32 Api

References · 13

• http://securityfocus.com/archive/1/471947/100/0/threaded · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2219 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2219 · Security Note
• http://secunia.com/advisories/25640 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-035 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1643 · Note
• http://us-cert.gov/cas/techalerts/TA07-163A.html · Note
• http://osvdb.org/35341 · Note
• http://securitytracker.com/id?1018230 · Note
• http://kb.cert.org/vuls/id/457281 · Note
• http://vupen.com/english/advisories/2007/2155 · Note
• http://securityfocus.com/bid/24370 · Note