Vulnerability-Lookup

CERTA-2007-AVI-361

Vulnerability from certfr_avis - Published: 2007-08-14 - Updated: 2007-08-14

Une vulnérabilité dans l'implémentation du Vector Markup Language (VML) dans Windows permettrait à un utilisateur malveillant d'exécuter un code à distance.

Description

Une vulnérabilité dans l'implémentation du Vector Markup Language (VML) dans Windows permettrait à un utilisateur malveillant d'exécuter un code à distance en incitant un utilisateur à visiter une page web ou à lire un courriel spécialement conçu. Le code est exécuté avec les droits de l'utilisateur victime.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Microsoft	Windows	Internet Explorer 6 sur Windows 2000 SP4, Windows XP SP2 et Pro x64 et x64 SP2, Windows Server 2003 toutes versions ;
	Microsoft	Windows	Internet Explorer 7 sur Windows Vista dont x64, Windows XP SP2 et Pro x64 et x64 SP2, Windows Server 2003 toutes versions.

References

Title

Publication Time

CVE-2007-1749 (GCVE-0-2007-1749)

Vulnerability from cvelistv5 – Published: 2007-08-14 22:00 – Updated: 2024-08-07 13:06

Summary

Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow.

Severity ?

No CVSS data available.

CWE

Assigner

microsoft

References

URL

Tags

	http://www.securityfocus.com/bid/25310	vdb-entryx_refsource_BID
	http://secunia.com/advisories/26409	third-party-advisoryx_refsource_SECUNIA
	http://research.eeye.com/html/advisories/publishe…	x_refsource_MISC
	http://www.us-cert.gov/cas/techalerts/TA07-226A.html	third-party-advisoryx_refsource_CERT
	http://www.securitytracker.com/id?1018568	vdb-entryx_refsource_SECTRACK
	https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS
	https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
	http://www.vupen.com/english/advisories/2007/2874	vdb-entryx_refsource_VUPEN
	http://securityreason.com/securityalert/3020	third-party-advisoryx_refsource_SREASON
	http://www.securityfocus.com/archive/1/476498/100…	mailing-listx_refsource_BUGTRAQ
	http://www.kb.cert.org/vuls/id/468800	third-party-advisoryx_refsource_CERT-VN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:06:26.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "25310",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25310"
          },
          {
            "name": "26409",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26409"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://research.eeye.com/html/advisories/published/AD20070814a.html"
          },
          {
            "name": "TA07-226A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-226A.html"
          },
          {
            "name": "1018568",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018568"
          },
          {
            "name": "MS07-050",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-050"
          },
          {
            "name": "oval:org.mitre.oval:def:1784",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1784"
          },
          {
            "name": "ADV-2007-2874",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2874"
          },
          {
            "name": "3020",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3020"
          },
          {
            "name": "20070814 EEYE: VGX.DLL Compressed Content Heap Overflow Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/476498/100/0/threaded"
          },
          {
            "name": "VU#468800",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/468800"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-08-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "25310",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25310"
        },
        {
          "name": "26409",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26409"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://research.eeye.com/html/advisories/published/AD20070814a.html"
        },
        {
          "name": "TA07-226A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA07-226A.html"
        },
        {
          "name": "1018568",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018568"
        },
        {
          "name": "MS07-050",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-050"
        },
        {
          "name": "oval:org.mitre.oval:def:1784",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1784"
        },
        {
          "name": "ADV-2007-2874",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2874"
        },
        {
          "name": "3020",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3020"
        },
        {
          "name": "20070814 EEYE: VGX.DLL Compressed Content Heap Overflow Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/476498/100/0/threaded"
        },
        {
          "name": "VU#468800",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/468800"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2007-1749",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "25310",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25310"
            },
            {
              "name": "26409",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26409"
            },
            {
              "name": "http://research.eeye.com/html/advisories/published/AD20070814a.html",
              "refsource": "MISC",
              "url": "http://research.eeye.com/html/advisories/published/AD20070814a.html"
            },
            {
              "name": "TA07-226A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-226A.html"
            },
            {
              "name": "1018568",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018568"
            },
            {
              "name": "MS07-050",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-050"
            },
            {
              "name": "oval:org.mitre.oval:def:1784",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1784"
            },
            {
              "name": "ADV-2007-2874",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2874"
            },
            {
              "name": "3020",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3020"
            },
            {
              "name": "20070814 EEYE: VGX.DLL Compressed Content Heap Overflow Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/476498/100/0/threaded"
            },
            {
              "name": "VU#468800",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/468800"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2007-1749",
    "datePublished": "2007-08-14T22:00:00",
    "dateReserved": "2007-03-29T00:00:00",
    "dateUpdated": "2024-08-07T13:06:26.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted