Microsoft Charts ActiveX Control Memory Corruption Vulnerability

Bugtraq ID:	32614
Class:	Unknown
CVE:	CVE-2008-4256
Remote:	Yes
Local:	No
Published:	Dec 09 2008 12:00AM
Updated:	Apr 19 2013 02:40AM
Credit:	Michal Bucko, working with CERT/CC
Vulnerable:	Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual Studio .NET 2003 + Microsoft Visual Basic .NET Standard 2003 + Microsoft Visual C# .NET Standard 2003 + Microsoft Visual C++ .NET Standard 2003 + Microsoft Visual J# .NET Standard 2003 Microsoft Visual Studio .NET 2002 SP1 Microsoft Visual Studio .NET 2002 + Microsoft Visual Basic .NET Standard 2002 + Microsoft Visual C# .NET Standard 2002 + Microsoft Visual C++ .NET Standard 2002 Microsoft Visual FoxPro 9.0 SP2 Microsoft Visual FoxPro 9.0 SP1 Microsoft Visual FoxPro 8.0 SP1 Microsoft Visual Basic 6.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Charts ActiveX Control Memory Corruption Vulnerability

Microsoft Charts ActiveX control is prone to a remote memory-corruption vulnerability.

Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Microsoft Charts ActiveX Control Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Charts ActiveX Control Memory Corruption Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.


Microsoft Visual FoxPro 8.0 SP1

• Microsoft Visual FoxPro 8.0 SP1 ActiveX Controls Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=A6977F81-F7F6 -486B-96AD-8D296D79F205

Microsoft Visual FoxPro 9.0 SP1

• Microsoft Visual FoxPro 9.0 SP1 ActiveX Controls Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=386D27A6-B2C7 -4ACC-BF3E-EDCBC7358172

Microsoft Visual Basic 6.0

• Microsoft Microsoft Visual Basic 6.0 Service Pack 6 Cumulative Update
  http://www.microsoft.com/downloads/details.aspx?FamilyId=CB824E35-0403 -45C4-9E41-459F0EB89E36


• Microsoft Microsoft Visual Basic 6.0 Service Pack 6 Security Rollup Update
  http://www.microsoft.com/downloads/details.aspx?familyid=E27EEBCB-095D -43EC-A19E-4A46E591715C

Microsoft Visual Studio .NET 2003 SP1

• Microsoft Visual Studio .NET 2003 Service Pack 1 ActiveX Controls Security Update Rollup
  http://www.microsoft.com/downloads/details.aspx?familyid=6AC7CF8F-D046 -43A8-B4EF-253153D65AED

Microsoft Visual FoxPro 9.0 SP2

• Microsoft Visual FoxPro 9.0 SP2 ActiveX Controls Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=5B1F28A9-DA8D -463A-8AE4-DFC8FCC6C41A

Microsoft Visual Studio .NET 2002 SP1

• Microsoft Visual Studio .NET 2002 Service Pack 1 Security Update Rollup
  http://www.microsoft.com/downloads/details.aspx?familyid=AFAD980D-7F27 -49D9-AA23-B762C7B94CD6

Microsoft Charts ActiveX Control Memory Corruption Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Microsoft Security Advisory 960715 (Microsoft)
  
• Microsoft Security Bulletin MS08-070 (Microsoft)