CVE-2007-2496

The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) GotoPage, (6) Save, (7) SaveWebFile, (8) HttpDownloadFile, (9) Open, (10) OpenWebFile, (11) SaveAs, or (12) ShowWordStandardDialog property value.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://moaxb.blogspot.com/2007/05/moaxb-03-wordviewerocx-32-multiple_03.html
http://osvdb.org/34334
http://secunia.com/advisories/25100
http://www.securityfocus.com/bid/23784
http://www.vupen.com/english/advisories/2007/1634
https://exchange.xforce.ibmcloud.com/vulnerabilities/34027

Configurations

Configuration 1 (hide)

cpe:2.3:a:office_ocx:word_viewer_ocx:3.2.0.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-05-04 00:19

Updated : 2024-02-28 11:01

NVD link : CVE-2007-2496

Mitre link : CVE-2007-2496

CVE.ORG link : CVE-2007-2496

JSON object : View

Products Affected

office_ocx

word_viewer_ocx

CWE

NVD-CWE-Other

{"id": "CVE-2007-2496", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-05-04T00:19:00.000", "references": [{"url": "http://moaxb.blogspot.com/2007/05/moaxb-03-wordviewerocx-32-multiple_03.html", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/34334", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/25100", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/23784", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/1634", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34027", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) GotoPage, (6) Save, (7) SaveWebFile, (8) HttpDownloadFile, (9) Open, (10) OpenWebFile, (11) SaveAs, or (12) ShowWordStandardDialog property value."}, {"lang": "es", "value": "El control ActiveX WordOCX en WordViewer.ocx 3.2.0.5 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (c\u00e1ida de Internet Explorer 7) mediante un valor de propiedad largo (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) GotoPage, (6) Save, (7) SaveWebFile, (8) HttpDownloadFile, (9) Open, (10) OpenWebFile, (11) SaveAs, \u00f3 (12) ShowWordStandardDialog."}], "lastModified": "2017-07-29T01:31:30.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:office_ocx:word_viewer_ocx:3.2.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7C9AA67-6092-4FB5-BFFD-8A35B16DC2A7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}