PT-2008-5539 · Microsoft · Visual Studio .Net+3

Brett Moore + 2 · Published 2008-12-10 · Updated 2018-10-12 · CVE-2008-4255

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1

Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user.

Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-4255

Affected Products

Visual Basic 6.0

Office Project

Visual Foxpro

Visual Studio .Net

References · 15

• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl · Exploit
• 🔥 https://exploit-db.com/exploits/7431 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4255 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 · Vendor Advisory
• http://vupen.com/english/advisories/2008/3382 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4255 · Security Note
• http://securityfocus.com/bid/32613 · Patch
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-070 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4255 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6032 · Note
• http://zerodayinitiative.com/advisories/ZDI-08-083 · Note
• http://securityfocus.com/archive/1/499061/100/0/threaded · Note
• http://securitytracker.com/id?1021369 · Note
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm · Note