CVE-2008-3704

Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."

Link	Resource
http://www.securityfocus.com/bid/30674	Exploit Patch
http://www.securitytracker.com/id?1020710
http://www.us-cert.gov/cas/techalerts/TA08-344A.html	US Government Resource
http://secunia.com/advisories/31498	Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
http://www.vupen.com/english/advisories/2008/3382	Vendor Advisory
http://www.vupen.com/english/advisories/2008/2380	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44444
https://www.exploit-db.com/exploits/6317
https://www.exploit-db.com/exploits/6244
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5794
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070

Configuration 1

cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_studio:6.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*

---

Published : 2008-08-18 07:41

Updated : 2018-10-12 09:48

---

NVD link : CVE-2008-3704

Mitre link : CVE-2008-3704

No products.

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer