Microsoft IAG 2007 ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
BID:34532
Info
Microsoft IAG 2007 ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
| Bugtraq ID: | 34532 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-2238 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2009 12:00AM |
| Updated: | Apr 21 2009 12:26AM |
| Credit: | Will Dormann of CERT/CC |
| Vulnerable: |
Microsoft Intelligent Application Gateway 2007 3.7 |
| Not Vulnerable: |
Microsoft Intelligent Application Gateway 2007 3.7 SP2 |
Discussion
Microsoft IAG 2007 ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
The Microsoft Intelligent Application Gateway (IAG) 2007 Client Components ActiveX Control is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. The ActiveX control is identified by CLSID:
8D9563A9-8D5F-459B-87F2-BA842255CB9A
Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
NOTE: IAG was formerly known as Whale Communications Intelligent Application Gateway.
Versions prior to IAG 2007 3.7 SP2 are vulnerable.
The Microsoft Intelligent Application Gateway (IAG) 2007 Client Components ActiveX Control is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. The ActiveX control is identified by CLSID:
8D9563A9-8D5F-459B-87F2-BA842255CB9A
Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
NOTE: IAG was formerly known as Whale Communications Intelligent Application Gateway.
Versions prior to IAG 2007 3.7 SP2 are vulnerable.
Exploit / POC
Microsoft IAG 2007 ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Microsoft IAG 2007 ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
Solution:
The vendor has released updates. Please contact the vendor for details.
Microsoft Intelligent Application Gateway 2007 3.7
Solution:
The vendor has released updates. Please contact the vendor for details.
Microsoft Intelligent Application Gateway 2007 3.7
-
Microsoft Microsoft Whale Communications Intelligent Application Gateway 2007 Service Pack 2
http://www.microsoft.com/downloads/details.aspx?FamilyID=e69dfd1d-d333 -4c27-9246-279ada224317&displaylang=en
References
Microsoft IAG 2007 ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities
References:
References: