PT-2007-6004 · Microsoft · Visual Studio

Shinnai · Published 2007-09-14 · Updated 2017-09-29 · CVE-2007-4890

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio 6.0

Description: The issue allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveAs method. It is also possible to copy contents from local files via the Load method.

Recommendations: For Microsoft Visual Studio 6.0, consider restricting access to the SaveAs method and the Load method in the VB To VSI Support Library until a fix is available. As a temporary workaround, avoid using the SaveAs method with full pathnames and be cautious when using the Load method to prevent copying contents from unauthorized local files.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-4890

Affected Products

Visual Studio

References · 6

• 🔥 https://exploit-db.com/exploits/4394 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4890 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36571 · Note
• http://securityfocus.com/bid/25635 · Note
• http://shinnai.altervista.org/exploits/txt/TXT_qwFZc3a35RLy5AGxVBjJ.html · Note
• http://secunia.com/advisories/26779 · Note