Vulnerabilities > CVE-2008-4253 - Resource Management Errors vulnerability in Microsoft products

047910
CVSS 8.5 - HIGH
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
SINGLE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-399
nessus

Summary

The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "FlexGrid Control Memory Corruption Vulnerability."

Common Weakness Enumeration (CWE)

Msbulletin

bulletin_idMS08-070
bulletin_url
date2008-12-09T00:00:00
impactRemote Code Execution
knowledgebase_id932349
knowledgebase_url
severityCritical
titleVulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution

Nessus

  • NASL familyWindows
    NASL idSMB_KB_960715.NASL
    descriptionThe remote host is missing a list of kill bits for ActiveX controls that are known to contain vulnerabilities. If these ActiveX controls are ever installed on the remote host, either now or in the future, they would expose it to various security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id35634
    published2009-02-11
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35634
    titleMS KB960715: Cumulative Security Update of ActiveX Kill Bits
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
     script_id(35634);
     script_version("1.32");
     script_cvs_date("Date: 2018/11/15 20:50:28");
    
     script_cve_id(
      "CVE-2008-4252",
      "CVE-2008-4253",
      "CVE-2008-4254",
      "CVE-2008-4255",
      "CVE-2008-4256",
      "CVE-2009-0305"
     );
     script_bugtraq_id(33663);
     script_xref(name:"IAVA", value:"2008-A-0088");
     script_xref(name:"IAVA", value:"2009-A-0016");
     script_xref(name:"IAVB", value:"2009-B-0009");
     script_xref(name:"MSKB", value:"960715");
    
     script_name(english:"MS KB960715: Cumulative Security Update of ActiveX Kill Bits");
     script_summary(english:"Determines if the newest kill bits are set");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is missing a security update containing
    ActiveX kill bits.");
     script_set_attribute(attribute:"description", value:
    "The remote host is missing a list of kill bits for ActiveX controls
    that are known to contain vulnerabilities. 
    
    If these ActiveX controls are ever installed on the remote host,
    either now or in the future, they would expose it to various security
    issues.");
     script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2009/960715");
     script_set_attribute(attribute:"solution", value:
    "Microsoft has released an advisory for KB960715.");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
     script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"true");
     script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
     script_set_attribute(attribute:"canvas_package", value:'D2ExploitPack');
     script_cwe_id(119, 189, 264, 399);
    
     script_set_attribute(attribute:"plugin_publication_date", value:"2009/02/11");
     script_set_attribute(attribute:"plugin_type", value:"local");
     script_set_attribute(attribute:"cpe",value:"cpe:/o:microsoft:windows");
     script_set_attribute(attribute:"stig_severity", value:"I");
     script_end_attributes();
     
     script_category(ACT_GATHER_INFO);
     
     script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
     script_family(english:"Windows");
     
     script_dependencies("smb_hotfixes.nasl");
     script_require_keys("SMB/Registry/Enumerated", "SMB/WindowsVersion");
     script_require_ports(139, 445);
     exit(0);
    }
    
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_activex_func.inc");
    
    
    if (!get_kb_item("SMB/Registry/Enumerated")) exit(0, "The 'SMB/Registry/Enumerated' KB item is missing.");
    if (hotfix_check_sp(win2k:6, xp:4, win2003:3, vista:2) <= 0)
      exit(0, "The host is not affected based on its version / service pack.");
    if (hotfix_check_server_core() == 1) exit(0, "Windows Server Core installs are not affected.");
    if (activex_init() != ACX_OK) exit(1, "Unable to initialize the ActiveX API.");
    
    
    # Test each control.
    info = "";
    clsids = make_list(
      "{FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1}",
      "{4788DE08-3552-49EA-AC8C-233DA52523B9}",
      "{1E216240-1B7D-11CF-9D53-00AA003C9CB6}",
      "{3A2B370C-BA0A-11d1-B137-0000F8753F5D}",
      "{B09DE715-87C1-11d1-8BE3-0000F8754DA1}",
      "{cde57a43-8b86-11d0-b3c6-00a0c90aea82}",
      "{6262d3a0-531b-11cf-91f6-c2863c385e30}",
      "{0ECD9B64-23AA-11d0-B351-00A0C9055D8E}",
      "{C932BA85-4374-101B-A56C-00AA003668DC}",
      "{248dd896-bb45-11cf-9abc-0080c7e7b78d}"
    );
    
    foreach clsid (clsids)
    {
      if (activex_get_killbit(clsid:clsid) == 0)
      {
        info += '  ' + clsid + '\n';
        if (!thorough_tests) break;
      }
    }
    activex_end();
    
    
    if (info)
    {
      if (report_verbosity > 0)
      {
        if (max_index(split(info)) > 1) s = "s";
        else s = "";
    
        report = string(
          "\n",
          "The kill bit has not been set for the following control", s, " :\n",
          "\n",
          info
        );
    
        if (!thorough_tests)
        {
          report = string(
            report,
            "\n",
            "Note that Nessus did not check whether there were other kill bits\n",
            "that have not been set because the 'Perofrm thorough tests' setting\n",
            "was not enabled when this scan was run.\n"
          );
        }
        security_warning(port:kb_smb_transport(), extra:report);
      }
      else security_warning(kb_smb_transport());
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS08-070.NASL
    descriptionThe remote host contains a version of the ActiveX control for Visual Basic 6.0 Runtime Extended Files that may allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it. Note that this control may have been included with Visual Studio or FoxPro or as part of a third-party application created by one of those products.
    last seen2020-06-01
    modified2020-06-02
    plugin id35069
    published2008-12-10
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35069
    titleMS08-070: Vulnerabilities in Visual Basic 6.0 ActiveX Controls Could Allow Remote Code Execution (932349)

Oval

accepted2012-11-12T04:00:35.411-05:00
classvulnerability
contributors
  • nameSudhir Gandhe
    organizationSecure Elements, Inc.
  • namePradeep R B
    organizationSecPod Technologies
  • namePradeep R B
    organizationSecPod Technologies
definition_extensions
  • commentMicrosoft Project 2003 SP3 is installed
    ovaloval:org.mitre.oval:def:5755
  • commentMicrosoft Office XP is installed
    ovaloval:org.mitre.oval:def:663
  • commentMicrosoft Visual FoxPro is installed
    ovaloval:org.mitre.oval:def:14198
  • commentMicrosoft Visual Basic 6.0 is installed
    ovaloval:org.mitre.oval:def:15369
descriptionThe FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "FlexGrid Control Memory Corruption Vulnerability."
familywindows
idoval:org.mitre.oval:def:5994
statusaccepted
submitted2008-12-09T13:31:00
titleFlexGrid Control Memory Corruption Vulnerability
version68