CVE-2007-2884
published 2007-05-30CVE-2007-2884: Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU consumption) or…
PriorityP349critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
36.22%
98.5th percentile
Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU consumption) or execute arbitrary code via a Visual Basic Project (vbp) file with a long (1) Description or (2) Company Name (VersionCompanyName) field.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_basic | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The overflow corrupts registers ESI and EDI; ESI points to the overflowed company name buffer at memory address 0x04520020. Crash analysis showing ESI/EDI filled with attacker-controlled data (e.g., 0x41414141) in VB6.exe is a strong indicator of exploitation. ↗
- →The Description overflow crash point is at VB6.exe offset 0x004A2E43; a crash or exception at this EIP during .vbp parsing indicates active exploitation of the Description field vector. ↗
- →SEH-based exploitation is viable for the Description overflow vector; monitor for SEH chain overwrites in VB6.exe process space when loading external .vbp files. ↗
- →The vulnerability is triggered only when the Project Properties page (Company Name tab) is opened in the VB6 IDE; file-open events for .vbp files followed by IDE property-page navigation should be monitored. ↗
- ·This is a local/user-assisted attack; the victim must open the crafted .vbp file in the Visual Basic 6 IDE. Remote exploitation requires social engineering to deliver the malicious project file. ↗
- ·A compiled binary generated from the crafted .vbp will not display vendor/version information in the EXE, which may serve as a secondary indicator of a tampered project. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Visual Basic 6.0 Project - Company Name Stack Overflow (PoC)
exploitdb·2007-05-23
CVE-2007-2884 Microsoft Visual Basic 6.0 Project - Company Name Stack Overflow (PoC)
Microsoft Visual Basic 6.0 Project - Company Name Stack Overflow (PoC)
---
#!/usr/local/bin/perl
#Discovered By UmZ (Umair Manzoor)
#comments are welcome at umz32.dll[at]gmail.com
#Dated 23-02-2007
#Time : 02:00 AM PST
#
#Visual Basic Project (Company Name) Stack Overflow
#Affected Version : Tested on Visual basic 6
#Threats : DoS, Previlidges Escilation (System become unstable for more then 40 minutes and so)
#From : Local system
#
#Actually Exception occur again and again and again make 100% usage of CPU
#
#
#*The vulnerability would not effect until the project description (Project Property page and select Company Name) has been opened up to view.
#
#*When binary file is generated with crafted Visual basic project it would not contain any details of vendor and other information.
#D
Exploit-DB
Microsoft Visual Basic 6.0 Project - Description Stack Overflow (PoC)
exploitdb·2007-05-23
CVE-2007-2884 Microsoft Visual Basic 6.0 Project - Description Stack Overflow (PoC)
Microsoft Visual Basic 6.0 Project - Description Stack Overflow (PoC)
---
#!/usr/local/bin/perl
#Discovered By UmZ (Umair Manzoor)
#comments are welcome at umz32.dll[at]gmail.com
#Dated 23-02-2007
#Time : 02:00 AM PST
#
#Stack Overflow
#Buffer Size 1037690
#overflow offset 004A2E43
#EBX contain values
#Memory to write 03B50188
#
#
#
#
#Visual Basic Project Description Stack overflow
#Affected Version : Tested on Visual basic 6
#Threats : DoS, Previlidges Escilation
#From : Local system
#
#
#Details:
# Microsoft Visual Basic 6.0 IDE crashes while parsing the project detail's field when characters more then 1037690 are provided,
# causing stack overflow (vuln1.vbp in attached file). The data is stored as UNICODE means that Shellcode can be injected in unicode manner
# to escilate previle
No writeups or analysis indexed.
http://osvdb.org/41052http://osvdb.org/41053http://www.securityfocus.com/bid/24128http://www.securityfocus.com/bid/24129https://exchange.xforce.ibmcloud.com/vulnerabilities/34475https://exchange.xforce.ibmcloud.com/vulnerabilities/34476https://www.exploit-db.com/exploits/3976https://www.exploit-db.com/exploits/3977http://osvdb.org/41052http://osvdb.org/41053http://www.securityfocus.com/bid/24128http://www.securityfocus.com/bid/24129https://exchange.xforce.ibmcloud.com/vulnerabilities/34475https://exchange.xforce.ibmcloud.com/vulnerabilities/34476https://www.exploit-db.com/exploits/3976https://www.exploit-db.com/exploits/3977
2007-05-30
Published