Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MS07-004 | First vendor Publication | 2007-01-09 |
| Vendor | Microsoft | Last vendor Modification | 2007-01-09 |
| Severity (Vendor) | Critical | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A remote code execution vulnerability exists in the Vector Markup Language (VML) implementation in Microsoft Windows. This update resolves a public vulnerability as well as additional issues discovered through internal investigations. The vulnerability is documented in the "Vulnerability Details" section of this bulletin. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/ms07-004.mspx?pubDate=2 (...) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1058 | |||
| Oval ID: | oval:org.mitre.oval:def:1058 | ||
| Title: | Vulnerability in Vector Markup Language (VML) Could Allow Remote Code Execution | ||
| Description: | Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-0024 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 2 |
SAINT Exploits
| Description | Link |
|---|---|
| Internet Explorer VML integer overflow | More info here |
ExploitDB Exploits
| id | Description |
|---|---|
| 2007-01-17 | MS Internet Explorer - VML Download and Execute Exploit (MS07-004) |
| 2007-01-16 | MS Internet Explorer - VML Remote Buffer Overflow Exploit (MS07-004) |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-07-08 | Name : Microsoft Windows Vector Markup Language Vulnerabilities (929969) File : nvt/ms07-004.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 31250 | Microsoft IE Vector Markup Language (VML) Overflow A heap buffer overflow exists in Microsoft Internet Explorer. The browser's vml rendering engine fails to check the length of a unspecified buffer. With a specially crafted request that contains vml graphics, an attacker can cause arbitrary code execution resulting in a loss of integrity. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows Vector Markup Language recolorinfo tag numcolors parameter ... RuleID : 9849 - Revision : 18 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows Vector Markup Language recolorinfo tag numfills parameter b... RuleID : 9848 - Revision : 14 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2007-01-09 | Name : Arbitrary code can be executed on the remote host through the email client or... File : smb_nt_ms07-004.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:45:35 |
|
| 2014-01-19 21:30:03 |
|
| 2013-05-11 00:49:14 |
|
