CVE-2007-4891

A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell.

Link	Resource
http://www.securityfocus.com/bid/25638	Exploit
http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.html
http://secunia.com/advisories/26779
http://osvdb.org/37106
https://exchange.xforce.ibmcloud.com/vulnerabilities/36572
https://www.exploit-db.com/exploits/4393

Configuration 1

cpe:2.3:a:microsoft:visual_studio:6.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_studio:6.0.0.9782:*:*:*:*:*:*:*

---

Published : 2007-09-14 01:17

Updated : 2017-09-29 01:29

---

NVD link : CVE-2007-4891

Mitre link : CVE-2007-4891

No products.

CWE-78