CVE-2008-3704
published 2008-08-18CVE-2008-3704: Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual…
PriorityP271critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
55.92%
98.9th percentile
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_basic | — | — |
| microsoft | visual_foxpro | — | — |
| microsoft | visual_foxpro | — | — |
| microsoft | visual_studio | — | — |
| microsoft | visual_studio_net | — | — |
| microsoft | visual_studio_net | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%0C (repeated 1945 times as heap spray NOP sled)
- →Detect heap spray patterns using repeated 0x0C bytes (unescape('%0C')) in JavaScript, a technique used in the wild PoC to position shellcode before triggering the overflow via the Mask parameter. ↗
- →Alert on exploitation of the Mask property of the MaskedEdit ActiveX control (Class MaskEdBox, Msmask32.ocx) with an abnormally long string value, which triggers the heap buffer overflow. ↗
- →The Metasploit module targets this vulnerability as a browser exploit delivered over HTTP; monitor for suspicious HTML pages embedding the MaskedEdit ActiveX CLSID with large Mask parameter values. ↗
- ·Versions of Msmask32.ocx prior to 6.0.84.18 are affected; version 6.0.81.69 is the confirmed vulnerable version. Detections should account for all pre-patch versions. ↗
- ·The Metasploit module randomizes all JavaScript variable names to evade signature-based detection; string-based JS signatures on variable names will be ineffective. Focus detection on the CLSID and heap spray byte patterns instead. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x556-3584-m3v7: Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32
ghsa_unreviewed·2022-05-02
CVE-2008-3704 [HIGH] CWE-119 GHSA-x556-3584-m3v7: Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
VulnCheck
Microsoft visual_basic Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2008·CVSS 9.3
CVE-2008-3704 [CRITICAL] Microsoft visual_basic Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft visual_basic Improper Restriction of Operations within the Bounds of a Memory Buffer
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Affected: Microsoft visual_basic
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable
No detection rules found.
Exploit-DB
Microsoft Visual Studio - Msmask32.ocx ActiveX Buffer Overflow (MS08-070) (Metasploit)
exploitdb·2010-11-24
CVE-2008-3704 Microsoft Visual Studio - Msmask32.ocx ActiveX Buffer Overflow (MS08-070) (Metasploit)
Microsoft Visual Studio - Msmask32.ocx ActiveX Buffer Overflow (MS08-070) (Metasploit)
---
##
# $Id: ms08_070_visual_studio_msmask.rb 11127 2010-11-24 19:35:38Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft Visual Studio Msmask32.ocx ActiveX Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Microsoft's Visual Studio 6.0.
When passing a specially crafted string to the Mask parameter of the
Msmask32.ocx ActiveX Control, an attacker may be able to execute arbitrary
code.
},
'License' =>
Exploit-DB
Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow
exploitdb·2008-08-26
CVE-2008-3704 Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow
Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow
---
Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote Buffer Overflow Exploit
Author: Koshi
Original POC: http://www.milw0rm.com/exploits/6244 ( Not by me )
My first ActiveX exploit, learned quite a bit playing with this one.
Heaps are handy.
#################################################
Loaded File: C:\WINDOWS\system32\MSMASK32.OCX
Name: MSMask
Version: 1.1
Class MaskEdBox
GUID: {C932BA85-4374-101B-A56C-00AA003668DC}
Number of Interfaces: 1
Default Interface: IMSMask
RegKey Safe for Script: False
RegKey Safe for Init: True
KillBitSet: False
#################################################
gr33tz: Rima my baby, str0ke, mess, and to all of those who have helped me over the years!
function doIt()
{
var
Exploit-DB
Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)
exploitdb·2008-08-14
CVE-2008-3704 Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)
Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC)
---
var body='';
var buf='';
for (i=1;i<=1945;i++){buf=buf+unescape("%0C");}
document.write(body+buf+body1);
# milw0rm.com [2008-08-14]
Metasploit
Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow
metasploit
Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow
Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow
This module exploits a stack buffer overflow in Microsoft Visual Studio 6.0. When passing a specially crafted string to the Mask parameter of the Mdmask32.ocx ActiveX Control, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://secunia.com/advisories/31498http://support.avaya.com/elmodocs2/security/ASA-2008-473.htmhttp://www.securityfocus.com/bid/30674http://www.securitytracker.com/id?1020710http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlhttp://www.vupen.com/english/advisories/2008/2380http://www.vupen.com/english/advisories/2008/3382https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070https://exchange.xforce.ibmcloud.com/vulnerabilities/44444https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5794https://www.exploit-db.com/exploits/6244https://www.exploit-db.com/exploits/6317http://secunia.com/advisories/31498http://support.avaya.com/elmodocs2/security/ASA-2008-473.htmhttp://www.securityfocus.com/bid/30674http://www.securitytracker.com/id?1020710http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlhttp://www.vupen.com/english/advisories/2008/2380http://www.vupen.com/english/advisories/2008/3382https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070https://exchange.xforce.ibmcloud.com/vulnerabilities/44444https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5794https://www.exploit-db.com/exploits/6244https://www.exploit-db.com/exploits/6317
2008-08-18
Published
Exploited in the wild