PT-2012-4029 · Microsoft+1 · Internet Explorer+1

Derek Soeder · Published 2012-04-25 · Updated 2021-07-23 · CVE-2012-2418

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:A/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intuit QuickBooks versions 2009 through 2012

Description The issue is related to a heap-based buffer overflow in the intu-help-qb handlers in HelpAsyncPluggableProtocol.dll. This occurs when Internet Explorer is used and a URI with a % (percent) character as its last or second-to-last character is accessed. The result can be a denial of service due to memory corruption or possibly the execution of arbitrary code.

Recommendations For Intuit QuickBooks versions 2009 through 2012, consider avoiding the use of Internet Explorer or restricting access to URIs that contain a % (percent) character as their last or second-to-last character until a fix is available. As a temporary workaround, disabling the intu-help-qb handlers in HelpAsyncPluggableProtocol.dll may help minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-2418

Affected Products

Internet Explorer

Intuit Quickbooks

References · 5

• 🔥 http://securityfocus.com/archive/1/522138 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2418 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75170 · Note
• http://kb.cert.org/vuls/id/232979 · Note
• http://osvdb.org/80820 · Note