PT-2007-3973 · Hewlett Packard · Magview Activex Control

Callax · Published 2007-05-14 · Updated 2017-10-11 · CVE-2007-2656

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Hewlett-Packard (HP) Magview ActiveX control version 1.0.0.309

Description The issue is related to a stack-based buffer overflow in the Hewlett-Packard (HP) Magview ActiveX control, which can be triggered by passing a long argument to the DeleteProfile method. This can cause a denial of service, resulting in an application crash, and potentially have other impacts.

Recommendations For version 1.0.0.309, consider disabling the DeleteProfile method as a temporary workaround until a patch is available. Restrict access to the hpqvwocx.dll module to minimize the risk of exploitation. Avoid using the DeleteProfile method with long arguments in the affected ActiveX control until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2656

Affected Products

Magview Activex Control

References · 5

• 🔥 http://securityfocus.com/bid/23941 · Exploit
• 🔥 https://exploit-db.com/exploits/3898 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2656 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34239 · Note
• http://osvdb.org/37787 · Note