Microsoft Visual FoxPro 6.0 Automatic Application Execution Vulnerability
BID:5633
Info
Microsoft Visual FoxPro 6.0 Automatic Application Execution Vulnerability
| Bugtraq ID: | 5633 |
| Class: | Unknown |
| CVE: |
CVE-2002-0696 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 04 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Credited to Cristobal Bielza and Juan Carlos G. Cuartango from Instituto Seguridad Internet. |
| Vulnerable: |
Microsoft Visual FoxPro 6.0 |
| Not Vulnerable: | |
Discussion
Microsoft Visual FoxPro 6.0 Automatic Application Execution Vulnerability
Microsoft Visual FoxPro 6.0 and the runtime component are vulnerable to a condition that may allow for remote attackers to execute database and system commands on client hosts.
This occurs due to two issues with FoxPro. The first issue is that FoxPro does not register application file extensions (.app) with Internet Explorer. As a result, there is no warning prompt before Explorer downloads FoxPro application files. The second issue is that specially constructed application filenames can cause FoxPro to execute the application immediately, without user interaction.
Attackers may exploit this vulnerability by luring victims to malicious webpages designed to automatically invoke FoxPro applications.
It is important to note that victims need not have installed the FoxPro product to be vulnerable. The runtime engine may be installed automatically by other applications without user knowledge. To identify whether FoxPro is installed, users or administrators should search for the following files:
vfp6r.dll, vfp6t.dll, or vfp6run.exe
If any of these files are present, the patch available from Microsoft should be installed.
Microsoft Visual FoxPro 6.0 and the runtime component are vulnerable to a condition that may allow for remote attackers to execute database and system commands on client hosts.
This occurs due to two issues with FoxPro. The first issue is that FoxPro does not register application file extensions (.app) with Internet Explorer. As a result, there is no warning prompt before Explorer downloads FoxPro application files. The second issue is that specially constructed application filenames can cause FoxPro to execute the application immediately, without user interaction.
Attackers may exploit this vulnerability by luring victims to malicious webpages designed to automatically invoke FoxPro applications.
It is important to note that victims need not have installed the FoxPro product to be vulnerable. The runtime engine may be installed automatically by other applications without user knowledge. To identify whether FoxPro is installed, users or administrators should search for the following files:
vfp6r.dll, vfp6t.dll, or vfp6run.exe
If any of these files are present, the patch available from Microsoft should be installed.
Exploit / POC
Microsoft Visual FoxPro 6.0 Automatic Application Execution Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Microsoft Visual FoxPro 6.0 Automatic Application Execution Vulnerability
Solution:
Microsoft has released a patch:
Microsoft Visual FoxPro 6.0
Solution:
Microsoft has released a patch:
Microsoft Visual FoxPro 6.0
-
Microsoft Q326568
http://www.microsoft.com/downloads/Release.asp?ReleaseID=42297
References
Microsoft Visual FoxPro 6.0 Automatic Application Execution Vulnerability
References:
References:
- Microsoft Security Bulletin MS02-049 (Microsoft)