RETIRED: Microsoft Visual FoxPro 'vfp6r.dll' ActiveX Control Arbitrary Command Execution

Bugtraq ID:	27205
Class:	Design Error
CVE:	CVE-2008-0236
Remote:	Yes
Local:	No
Published:	Jan 09 2008 12:00AM
Updated:	May 12 2015 07:49PM
Credit:	shinnai is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Visual FoxPro 6.0 + Microsoft Visual Studio 6.0 + Microsoft Visual Studio 6.0
Not Vulnerable:

RETIRED: Microsoft Visual FoxPro 'vfp6r.dll' ActiveX Control Arbitrary Command Execution

Microsoft Visual FoxPro ActiveX control is prone to a vulnerability that lets attackers execute arbitrary commands.

Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of the application using the ActiveX control (typically Internet Explorer).

Microsoft Visual FoxPro 6.0 is vulnerable to this issue; other versions may also be affected.

NOTE: This BID is being retired because the issue is not exploitable. The ActiveX control is not marked 'Safe for Scripting'.

RETIRED: Microsoft Visual FoxPro 'vfp6r.dll' ActiveX Control Arbitrary Command Execution

To exploit this issue, an attacker must entice an unsuspecting user to access a malicious webpage.

The following exploit code is available:

• /data/vulnerabilities/exploits/27205.html

RETIRED: Microsoft Visual FoxPro 'vfp6r.dll' ActiveX Control Arbitrary Command Execution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Microsoft Visual FoxPro 'vfp6r.dll' ActiveX Control Arbitrary Command Execution

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Visual FoxPro Homepage (Microsoft)