RETIRED: Microsoft VFP_OLE_Server ActiveX Control Remote Command Execution Vulnerability

Bugtraq ID:	27199
Class:	Input Validation Error
CVE:	CVE-2008-0235
Remote:	Yes
Local:	No
Published:	Jan 09 2008 12:00AM
Updated:	May 12 2015 07:49PM
Credit:	shinnai is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft VFP_OLE_Server ActiveX Control 0 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 2000 + Microsoft Internet Explorer 5.0
Not Vulnerable:

RETIRED: Microsoft VFP_OLE_Server ActiveX Control Remote Command Execution Vulnerability

Microsoft VFP_OLE_Server ActiveX control is prone to a remote command-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands with the privileges of the currently logged-in user.

NOTE: This BID has been retired because the reporter states that this vulnerability does not apply as described.

RETIRED: Microsoft VFP_OLE_Server ActiveX Control Remote Command Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious HTML page.

The following exploit code is available:

• /data/vulnerabilities/exploits/27199.html

RETIRED: Microsoft VFP_OLE_Server ActiveX Control Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Microsoft VFP_OLE_Server ActiveX Control Remote Command Execution Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Visual FoxPro Homepage (Microsoft)