CVE-2007-4891

A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:microsoft:visual_studio:6.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio:6.0.0.9782:*:*:*:*:*:*:*

History

21 Nov 2024, 00:36

Type Values Removed Values Added
References () http://osvdb.org/37106 - () http://osvdb.org/37106 -
References () http://secunia.com/advisories/26779 - () http://secunia.com/advisories/26779 -
References () http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.html - () http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.html -
References () http://www.securityfocus.com/bid/25638 - Exploit () http://www.securityfocus.com/bid/25638 - Exploit
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/36572 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/36572 -
References () https://www.exploit-db.com/exploits/4393 - () https://www.exploit-db.com/exploits/4393 -

Information

Published : 2007-09-14 01:17

Updated : 2024-11-21 00:36


NVD link : CVE-2007-4891

Mitre link : CVE-2007-4891

CVE.ORG link : CVE-2007-4891


JSON object : View

Products Affected

microsoft

  • visual_studio
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')