PT-2007-3560 · Microsoft · Speech Api+1

Published 2007-06-12 · Updated 2021-07-23 · CVE-2007-2222

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 through 7

Description The issue is related to multiple buffer overflows in speech controls used by Microsoft Internet Explorer, allowing remote attackers to execute arbitrary code via a crafted ActiveX object. This can trigger memory corruption, potentially demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS. A remote code execution vulnerability exists in a component of Microsoft Speech API 4, which could be exploited by constructing a specially crafted Web page, allowing an attacker to take complete control of an affected system.

Recommendations For Microsoft Internet Explorer versions 5.01 through 7, consider disabling the ActiveListen and ActiveVoice speech controls until a patch is available. As a temporary workaround, avoid using the ModeName parameter in the affected FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS to minimize the risk of exploitation.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-2222

Affected Products

Internet Explorer

Speech Api

References · 19

• 🔥 http://exploit-db.com/exploits/4065 · Exploit
• 🔥 https://exploit-db.com/exploits/4066 · Exploit
• 🔥 https://exploit-db.com/exploits/4065 · Exploit
• http://secunia.com/advisories/25627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2222 · Security Note
• http://vupen.com/english/advisories/2007/2153 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2222 · Security Note
• http://securityfocus.com/archive/1/471947/100/0/threaded · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033 · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-033 · Note
• http://us-cert.gov/cas/techalerts/TA07-163A.html · Note
• http://retrogod.altervista.org/win_speech_2k_sp4.html · Note
• http://securityfocus.com/bid/24426 · Note
• http://securitytracker.com/id?1018235 · Note
• http://retrogod.altervista.org/win_speech_xp_sp2.html · Note