CVE-2007-1512

Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Gold and SP1, and Visual Studio .NET 2002 Gold and SP1, and 2003 Gold and SP1 allows user-assisted remote attackers to have an unknown impact (probably crash) via an RTF file with a malformed OLE object, which results in writing two 0x00 characters past the end of szBuffer, aka the "MFC42u.dll Off-by-Two Overflow." NOTE: this issue is due to an incomplete patch (MS07-012) for CVE-2007-0025.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/archive/1/463009/100/0/threaded
http://www.securityfocus.com/archive/1/463009/100/0/threaded

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
	cpe:2.3:o:microsoft:windows_2003_server:gold:::::::*
	cpe:2.3:o:microsoft:windows_2003_server:sp1:::::::*
	cpe:2.3:o:microsoft:windows_xp::sp2::::::*

OR	cpe:2.3:a:microsoft:visual_studio_.net:2002:gold::::::
	cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1::::::
	cpe:2.3:a:microsoft:visual_studio_.net:2003:gold::::::
	cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1::::::

History

21 Nov 2024, 00:28

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/archive/1/463009/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/463009/100/0/threaded -

Information

Published : 2007-03-20 10:19

Updated : 2024-11-21 00:28

NVD link : CVE-2007-1512

Mitre link : CVE-2007-1512

CVE.ORG link : CVE-2007-1512

JSON object : View

Products Affected

microsoft

windows_2003_server
windows_xp
windows_2000
visual_studio_.net

CWE

NVD-CWE-Other

{"id": "CVE-2007-1512", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-03-20T10:19:00.000", "references": [{"url": "http://www.securityfocus.com/archive/1/463009/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/463009/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Gold and SP1, and Visual Studio .NET 2002 Gold and SP1, and 2003 Gold and SP1 allows user-assisted remote attackers to have an unknown impact (probably crash) via an RTF file with a malformed OLE object, which results in writing two 0x00 characters past the end of szBuffer, aka the \"MFC42u.dll Off-by-Two Overflow.\" NOTE: this issue is due to an incomplete patch (MS07-012) for CVE-2007-0025."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n AfxOleSetEditMenu en el componente MFC de Microsoft Windows 2000 SP4, XP SP2, y Server 2003 Gold y SP1, y Visual Studio .NET 2002 Gold y SP1, y 2003 Gold y SP1 permite a atacantes remotos con la complicidad del usuario tener un impacto desconocido (posiblemente ca\u00edda) mediante un fichero RTF con un objeto OLE mal formado, lo cual resulta en la escritura de 2 caracteres 0x00 pasado el final de szBuffer, tambi\u00e9n conocido como \"MFC42u.dll Off-by-Two Overflow\". NOTA: este asunto es debido a un parche incompleto (MS07-012) para CVE-2007-0025."}], "lastModified": "2024-11-21T00:28:29.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "83E7C4A0-78CF-4B56-82BF-EC932BDD8ADF"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B058588A-88F3-4789-8EA9-0D37447B08CA"}, {"criteria": "cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "644E2E89-F3E3-4383-B460-424D724EE62F"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2002:gold:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E17BD019-DD35-413E-ACBA-2E77C8A1247D"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "747E3E3A-85C1-4E55-B7F8-C5207F247498"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:gold:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9E6C132-4F4B-4FB0-9DDC-DD9750D8552D"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85959AEB-2FE5-4A25-B298-F8223CE260D6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}