36395 : Microsoft IE ActiveX (pdwizard.ocx) Unspecified Memory Corruption
Printer | http://osvdb.org/36395 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
8	1667	almost 6 years ago	11 months ago	3 times	100%

Timeline

Disclosure Date
2007-08-14

Description

Internet Explorer contains a flaw that may allow a malicious user to remotely execute arbitrary code. The issue is due to an unspecified vulnerability in the pdwizard.ocx Active X object and is related to MS VB6 objects and memory corruption. It is possible that the flaw may result in a loss of integrity.

Classification

Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation, Other
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

Microsoft has released MS07-45 to address this issue. Additionally, it is possible to correct the flaw by implementing the following workaround(s): prevent COM objects from running in IE and/or configure Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.

Products

Microsoft Corporation	Internet Explorer	5.01
		6 SP1
		7

References

Security Tracker: 1018562
CVE ID: 2007-3041 (see also: NVD)
OVAL ID: 2232
Bugtraq ID: 25295
Secunia Advisory ID: 26419
SCIP VulDB ID: 3245
Related OSVDB ID: 36396 36397
Microsoft Knowledge Base Article: 937143
VUPEN Advisory: ADV-2007-2869
News Article: http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9030696
Vendor URL: http://www.microsoft.com/en-us/default.aspx
Microsoft Security Bulletin: MS07-045

Tools & Filters

Snort	12261 12262 12263 12264 13321 13322 13323 13324
	25883

Credit

Not Available

CVSSv2 Score

CVSSv2 Base Score = 9.3
Source: nvd.nist.gov | Generated: 2007-08-15 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.