CVE-2008-3704 Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .N...
HighCVSS 9.3
EPSS 55.9%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft visual basic | = 6.0 | No fix listed |
| Microsoft visual foxpro | = 8.0-sp1 | No fix listed |
| Microsoft visual foxpro | = 9.0-sp1 | No fix listed |
| Microsoft visual foxpro | = 9.0-sp2 | No fix listed |
| Microsoft visual studio | = 6.0 | No fix listed |
| Microsoft visual studio .net | = 2002-sp1 | No fix listed |
| Microsoft visual studio .net | = 2003-sp1 | No fix listed |
References
- 31498 third-party-advisory vendor-advisory
- support.avaya.com
- 30674 exploit patch vdb-entry
- 1020710 vdb-entry
- TA08-344A third-party-advisory us-government-resource
- ADV-2008-2380 vdb-entry vendor-advisory
- ADV-2008-3382 vdb-entry vendor-advisory
- MS08-070 vendor-advisory
- visualstudio-maskededit-bo(44444) vdb-entry
- oval:org.mitre.oval:def:5794 signature vdb-entry
- 6244 exploit
- 6317 exploit