PT-2007-3820 · Microsoft · Internet Explorer

Shinnai · Published 2007-05-04 · Updated 2017-07-29 · CVE-2007-2496

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions WordViewer.ocx version 3.2.0.5

Description The issue allows remote attackers to cause a denial of service, specifically an Internet Explorer 7 crash, by exploiting the WordOCX ActiveX control in WordViewer.ocx. This can be achieved through a long value in various properties, including DoOleCommand, FTPDownloadFile, FTPUploadFile, HttpUploadFile, GotoPage, Save, SaveWebFile, HttpDownloadFile, Open, OpenWebFile, SaveAs, or ShowWordStandardDialog.

Recommendations For WordViewer.ocx version 3.2.0.5, consider restricting the use of the WordOCX ActiveX control to minimize the risk of exploitation. As a temporary workaround, avoid using long property values in the affected properties until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-2496

Affected Products

Internet Explorer

References · 8

• 🔥 https://exploit-db.com/exploits/3836 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2496 · Security Note
• http://moaxb.blogspot.com/2007/05/moaxb-03-wordviewerocx-32-multiple_03.html · Note
• http://osvdb.org/34334 · Note
• http://secunia.com/advisories/25100 · Note
• http://vupen.com/english/advisories/2007/1634 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34027 · Note
• http://securityfocus.com/bid/23784 · Note