CVE-2007-2496

published 2007-05-04

CVE-2007-2496: The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1)…

Priority P2 64 high 7.8 CVSS 2.0

AV N AC L Au N C N I N A C

ITW EXPLOIT VulnCheck KEV

The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand, (2) FTPDownloadFile, (3) FTPUploadFile, (4) HttpUploadFile, (5) GotoPage, (6) Save, (7) SaveWebFile, (8) HttpDownloadFile, (9) Open, (10) OpenWebFile, (11) SaveAs, or (12) ShowWordStandardDialog property value.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
office_ocx	word_viewer_ocx	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename WordViewer.ocx↗

version WordViewer.ocx 3.2.0.5↗

url http://ally.serveblog.net//loading.php?spl=ActiveX_pack↗

other CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61↗

url http://xxx/DownloaderActiveX.cab#Version=1,0,0,1↗

other aHR0cDovL2FsbHkuc2VydmVibG9nLm5ldC8vbG9hZGluZy5waHA/c3BsPWphdmFkbndiJg==↗

command arg1=String(2097512,"A")↗

• → Look for HTML pages loading the WordViewer.ocx ActiveX control via OBJECT tags with CODEBASE pointing to remote .cab or .ocx files, combined with parameter values containing very long strings (e.g., String(2097512, 'A') pattern — ~2 MB of repeated 'A' characters). ↗
• → Monitor for exploit delivery pages using the pattern 'loading.php?spl=ActiveX_pack' as a URL parameter, which was observed in-the-wild campaigns chaining CVE-2007-2496 with other ActiveX exploits. ↗
• → Flag use of CLSID c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61 in HTML OBJECT tags, associated with the DownloaderActiveX control used in the same exploit pack as CVE-2007-2496. ↗
• → The base64 value 'aHR0cDovL2FsbHkuc2VydmVibG9nLm5ldC8vbG9hZGluZy5waHA/c3BsPWphdmFkbndiJg==' decodes to a payload URL; detect this string in HTML PARAM VALUE fields as an obfuscation indicator. ↗

• · The exploit PoC was tested specifically against Windows XP Professional SP2 with Internet Explorer 7; other OS/browser combinations may behave differently. ↗
• · All software that uses WordViewer.ocx is stated to be vulnerable, not just the primary Word Viewer product — scope detection rules broadly to any application embedding this OCX. ↗

CVSS provenance

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C

vulncheck 7.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.