CVE-2008-4256

The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Charts Control Memory Corruption Vulnerability."

CVSS v2.0 8.5 HIGH

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
http://www.securityfocus.com/bid/32614
http://www.securitytracker.com/id?1021369
http://www.us-cert.gov/cas/techalerts/TA08-344A.html	US Government Resource
http://www.vupen.com/english/advisories/2008/3382
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5651

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:office_frontpage:2002:sp3::::::
	cpe:2.3:a:microsoft:project:2003:sp3::::::
	cpe:2.3:a:microsoft:project:2007:::::::*
	cpe:2.3:a:microsoft:project:2007:sp1::::::
	cpe:2.3:a:microsoft:visual_basic:6.0::runtime_extended_files:::::
	cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1::::::
	cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1::::::
	cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2::::::
	cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1::::::
	cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1::::::

History

No history.

Information

Published : 2008-12-10 14:00

Updated : 2023-12-10 10:51

NVD link : CVE-2008-4256

Mitre link : CVE-2008-4256

CVE.ORG link : CVE-2008-4256

JSON object : View

Products Affected

microsoft

visual_foxpro
visual_studio_.net
office_frontpage
visual_basic
project

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2008-4256", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-12-10T14:00:00.987", "references": [{"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm", "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/32614", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id?1021369", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "http://www.vupen.com/english/advisories/2008/3382", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5651", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the \"system state,\" aka \"Charts Control Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "El control ActiveX Charts en Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 y 2003 SP1, y Visual FoxPro 8.0 SP1 y 9.0 SP1 y SP2 no maneja adecuadamente errores durante el acceso de objetos inicializados incorrectamente, lo que permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de documentos HTML manipulados, relacionados con la corrupci\u00f3n del \"estado del sistema,\" tambi\u00e9n conocido como vulnerabilidad de corrupci\u00f3n de memoria en el control de caracteres.\""}], "lastModified": "2018-10-12T21:48:47.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_frontpage:2002:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2D429D9-577E-4CD6-ADEC-1119B60DB20F"}, {"criteria": "cpe:2.3:a:microsoft:project:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25881D4B-06E5-4083-AEEF-B6E1CE5C459A"}, {"criteria": "cpe:2.3:a:microsoft:project:2007:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CD3B021-8145-49FA-8809-C3976ED1BE62"}, {"criteria": "cpe:2.3:a:microsoft:project:2007:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "145E1D64-840B-4AE8-91CB-EA4884ED51D4"}, {"criteria": "cpe:2.3:a:microsoft:visual_basic:6.0:*:runtime_extended_files:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD65D7E8-016B-44EC-A416-E9247810CFF3"}, {"criteria": "cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5DE8B76-FA09-4EA2-9535-758C56C4C099"}, {"criteria": "cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "478347F8-6256-4DE6-AD6A-91631A9E6DD1"}, {"criteria": "cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E711CC3-9094-4C54-A794-9C7A3E7F4AFA"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "747E3E3A-85C1-4E55-B7F8-C5207F247498"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85959AEB-2FE5-4A25-B298-F8223CE260D6"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}