CVE-2008-3704
Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Un desbordamiento de búfer en la región heap de la memoria en el control ActiveX de MaskedEdit en msmask32.ocx versión 6.0.81.69, y posiblemente en otras versiones anteriores a 6.0.84.18, en Visual Studio versión 6.0, Visual Basic versión 6.0, Visual Studio .NET 2002 SP1 y 2003 SP1, y Visual FoxPro versiones 8.0 SP1 y 9.0 SP1 y SP2, de Microsoft, permite a los atacantes remotos ejecutar código arbitrario por medio de un parámetro Mask largo, relacionado con la no "validating property values with boundary checks", como se explotó “in the wild” en Agosto de 2008, también se conoce como "Masked Edit Control Memory Corruption Vulnerability".
CVSS Scores
SSVC
- Decision:-
Timeline
- 2008-08-18 CVE Reserved
- 2008-08-18 CVE Published
- 2010-11-24 First Exploit
- 2024-08-07 CVE Updated
- 2024-08-24 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm | X_refsource_confirm | |
| http://www.securitytracker.com/id?1020710 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA08-344A.html | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/44444 | Vdb Entry | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5794 | Signature |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/6244 | 2024-08-07 | |
| https://www.exploit-db.com/exploits/6317 | 2024-08-07 | |
| https://www.exploit-db.com/exploits/16507 | 2010-11-24 | |
| http://www.securityfocus.com/bid/30674 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/31498 | 2018-10-12 | |
| http://www.vupen.com/english/advisories/2008/2380 | 2018-10-12 | |
| http://www.vupen.com/english/advisories/2008/3382 | 2018-10-12 | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 | 2018-10-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Visual Basic Search vendor "Microsoft" for product "Visual Basic" | 6.0 Search vendor "Microsoft" for product "Visual Basic" and version "6.0" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Foxpro Search vendor "Microsoft" for product "Visual Foxpro" | 8.0 Search vendor "Microsoft" for product "Visual Foxpro" and version "8.0" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Foxpro Search vendor "Microsoft" for product "Visual Foxpro" | 9.0 Search vendor "Microsoft" for product "Visual Foxpro" and version "9.0" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Foxpro Search vendor "Microsoft" for product "Visual Foxpro" | 9.0 Search vendor "Microsoft" for product "Visual Foxpro" and version "9.0" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio Search vendor "Microsoft" for product "Visual Studio" | 6.0 Search vendor "Microsoft" for product "Visual Studio" and version "6.0" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio .net Search vendor "Microsoft" for product "Visual Studio .net" | 2002 Search vendor "Microsoft" for product "Visual Studio .net" and version "2002" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio .net Search vendor "Microsoft" for product "Visual Studio .net" | 2003 Search vendor "Microsoft" for product "Visual Studio .net" and version "2003" | sp1 |
Affected
| ||||||