Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Microsoft XML Core Services XMLDOM substringData() buffer overflow
Informations
Name VU#361968 First vendor Publication 2007-08-14
Vendor VU-CERT Last vendor Modification 2007-08-15
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#361968

Microsoft XML Core Services XMLDOM substringData() buffer overflow

Overview

Microsoft XML Core Services contains an unspecified memory corruption vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

I. Description

Microsoft XML Core Services (MSXML) allow developers who use JScript, Visual Basic Scripting Edition (VBScript), and Microsoft Visual Studio 6.0 to create XML-based applications. MSXML includes several ActiveX controls to allow XML support in Internet Explorer and other applications.

The MSXML XMLDOM object contains a buffer overflow vulnerability in the substringData() method.

II. Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

III. Solution

Apply an update

This issue is addressed by Microsoft Security Bulletin MS07-042. This update provides updated versions of MSXML.

Disable ActiveX and Active Scripting

Disabling ActiveX controls and Active Scripting in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this and other ActiveX vulnerabilities. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document.

Systems Affected

VendorStatusDate Updated
Microsoft CorporationVulnerable14-Aug-2007

References

http://www.cert.org/tech_tips/securing_browser/#Internet_Explorer
http://www.microsoft.com/technet/security/bulletin/ms07-042.mspx
http://www.iss.net/threats/274.html
http://secunia.com/advisories/26447/
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=576
http://msdn2.microsoft.com/en-us/library/ms755744.aspx
http://www.zerodayinitiative.com/advisories/ZDI-07-048.html

Credit

Thanks to Microsft for reporting this vulnerability, who in turn credit anonymous researchers working with Verisign iDefense VCP and Zero Day Initiative.

This document was written by Will Dormann.

Other Information

Date Public08/14/2007
Date First Published08/14/2007 02:27:31 PM
Date Last Updated08/15/2007
CERT Advisory 
CVE NameCVE-2007-2223
Metric24.10
Document Revision8

Original Source

Url : http://www.kb.cert.org/vuls/id/361968

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-190 Integer Overflow or Wraparound (CWE/SANS Top 25)
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:2069
 
Oval ID: oval:org.mitre.oval:def:2069
Title: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
Description: Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.
Family: windows Class: vulnerability
Reference(s): CVE-2007-2223
 Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
 Product(s): Microsoft XML Core Services
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 4

OpenVAS Exploits

Date Description
2011-01-14 Name : Microsoft XML Core Services Remote Code Execution Vulnerability (936227)
File : nvt/gb_ms07-042.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
36394 Microsoft XML Core Services (MSXML) Multiple Object Handling Overflow

Snort® IPS/IDS

Date Description
2014-01-10 Microsoft XML substringData integer overflow attempt
RuleID : 12279 - Revision : 15 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

Date Description
2007-08-14 Name : Arbitrary code can be executed on the remote host through the web or email cl...
File : smb_nt_ms07-042.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2015-05-08 13:28:02
  • Multiple Updates
2013-05-11 12:26:35
  • Multiple Updates