Microsoft Hierarchical FlexGrid ActiveX Control Memory Corruption Vulnerability

Bugtraq ID:	32612
Class:	Unknown
CVE:	CVE-2008-4254
Remote:	Yes
Local:	No
Published:	Dec 09 2008 12:00AM
Updated:	Feb 10 2009 09:48PM
Credit:	ADLab of VenusTech, Jason Medeiros of Affiliated Computer Services, and Carsten Eiram of Secunia Research
Vulnerable:	Microsoft Visual FoxPro 9.0 SP2 Microsoft Visual FoxPro 9.0 SP1 Microsoft Visual FoxPro 8.0 SP1 Microsoft Visual Basic 6.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Hierarchical FlexGrid ActiveX Control 6.0.88 .4
Not Vulnerable:

Microsoft Hierarchical FlexGrid ActiveX Control Memory Corruption Vulnerability

Microsoft Hierarchical FlexGrid ActiveX control is prone to a remote memory-corruption vulnerability.

Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Microsoft Hierarchical FlexGrid Control 6.0.88.4 is vulnerable; other versions may also be affected. The control is bundled with Microsoft Visual Basic 6.0 and Microsoft Visual FoxPro 8.0 SP1 and 9.0 SP 2.

Microsoft Hierarchical FlexGrid ActiveX Control Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Hierarchical FlexGrid ActiveX Control Memory Corruption Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.


Microsoft Visual FoxPro 8.0 SP1

• Microsoft Visual FoxPro 8.0 SP1 ActiveX Controls Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=A6977F81-F7F6 -486B-96AD-8D296D79F205

Microsoft Visual FoxPro 9.0 SP1

• Microsoft Visual FoxPro 9.0 SP1 ActiveX Controls Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=386D27A6-B2C7 -4ACC-BF3E-EDCBC7358172

Microsoft Visual Basic 6.0

• Microsoft Microsoft Visual Basic 6.0 Service Pack 6 Cumulative Update
  http://www.microsoft.com/downloads/details.aspx?FamilyId=CB824E35-0403 -45C4-9E41-459F0EB89E36


• Microsoft Microsoft Visual Basic 6.0 Service Pack 6 Security Rollup Update
  http://www.microsoft.com/downloads/details.aspx?familyid=E27EEBCB-095D -43EC-A19E-4A46E591715C

Microsoft Visual FoxPro 9.0 SP2

• Microsoft Visual FoxPro 9.0 SP2 ActiveX Controls Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=5B1F28A9-DA8D -463A-8AE4-DFC8FCC6C41A

Microsoft Hierarchical FlexGrid ActiveX Control Memory Corruption Vulnerability

References:

• Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows (Secunia Research)
  
• Microsoft Homepage (Microsoft)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows (Secunia Research )
  
• Microsoft Security Advisory 960715 (Microsoft)
  
• Microsoft Security Bulletin MS08-070 (Microsoft)