36396 : Microsoft IE ActiveX tblinf32.dll Unspecified Arbitrary Code Execution
Printer | http://osvdb.org/36396 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
14	2116	almost 6 years ago	almost 3 years ago	7 times	100%

Timeline

Disclosure Date
2007-08-14

Description

Internet Explorer contains a flaw that may permit a remote attacker to execute arbitrary code via unknown attack vectors. The issue is the result of an incorrect IObjectsafety implementation and MS VB6 objects. It is possible that the flaw may result in a loss of integrity.

Classification

Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation, Other
Impact: Loss of Integrity
Exploit: Exploit Commercial
Disclosure: Vendor Verified

Solution

Microsoft has released MS07-045 to address this issue. Additionally, it is possible to correct the flaw by implementing the following workaround(s): prevent COM objects from running in IE and/or configure Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.

Products

Microsoft Corporation	Internet Explorer	5.0 1
		6 SP1
		7

References

Security Tracker: 1018562
CVE ID: 2007-2216 (see also: NVD)
OVAL ID: 2109
Bugtraq ID: 25289
Secunia Advisory ID: 26419
SCIP VulDB ID: 3244
Related OSVDB ID: 36395 36397
Microsoft Knowledge Base Article: 937143
VUPEN Advisory: ADV-2007-2869
Keyword: aka "ActiveX Object Vulnerability"
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-08/0253.html
News Article: http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9030696
Generic Exploit URL: http://www.saintcorporation.com
http://www.saintcorporation.com/cgi-bin/exploit_info/ie_tblinf32_iobjectsafety
Microsoft Security Bulletin: MS07-045

Tools & Filters

Snort	12265 12266 12267 12268 12269 12270 12271 12272 12273 12274 12275 12276
	25883

Credit

Brett Moore - security-assessment.com

CVSSv2 Score

CVSSv2 Base Score = 9.3
Source: nvd.nist.gov | Generated: 2007-08-15 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.