Vulnerability CVE-2006-1043 - CERT Civis.Net

Vulnerability Name:

CVE-2006-1043 (CCN-25148)

Assigned:

2006-03-03

Published:

2006-03-03

Updated:

2018-10-18

Summary:

Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln).

CVSS v3 Severity:

5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
4.1 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List, Fri Mar 03 2006 - 18:46:40 CST
Visual Studio 6.0 Buffer Overflow Vulnerability

Source: MITRE
Type: CNA
CVE-2006-1043

Source: CCN
Type: SA19081
Microsoft Visual Studio ".dbp" File Handling Buffer Overflow

Source: SECUNIA
Type: Vendor Advisory
19081

Source: CCN
Type: SA28482
Microsoft Visual InterDev ".sln" File Handling Buffer Overflow

Source: CCN
Type: SECTRACK ID: 1015721
Visual Studio Buffer Overflow in `.dbp` and `.sln` Files Let Remote Users Cause Arbitrary Code to Be Executed

Source: SECTRACK
Type: Exploit, Vendor Advisory
1015721

Source: MISC
Type: Exploit, Vendor Advisory
http://www.frsirt.com/exploits/20060305.ms-visual-dbp.c.php

Source: OSVDB
Type: UNKNOWN
23711

Source: CCN
Type: OSVDB ID: 23711
Microsoft Visual Studio .dbp File DataProject Field Buffer Overflow

Source: BUGTRAQ
Type: UNKNOWN
20060304 Visual Studio 6.0 Buffer Overflow Vulnerability

Source: BUGTRAQ
Type: UNKNOWN
20060305 Microsoft Visual Studio 6.0 Sp6 Malformed .dbp File BoF Exploit

Source: BID
Type: UNKNOWN
16953

Source: CCN
Type: BID-16953
Microsoft Visual Studio DBP and SLN Files DataProject Buffer Overflow Vulnerability

Source: VUPEN
Type: Vendor Advisory
ADV-2006-0825

Source: XF
Type: UNKNOWN
visualstudio-dataproject-bo(25148)

Source: XF
Type: UNKNOWN
visualstudio-dataproject-bo(25148)

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:visual_interdev:6.0:*:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_studio:6.0:*:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_studio:6.0:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_studio:6.0:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_studio:6.0:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_studio:6.0:sp4:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_studio:6.0:sp5:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:visual_studio:6.0:*:*:*:*:*:*:*

OR cpe:/a:microsoft:visual_interdev:6.0:*:*:*:*:*:*:*

Denotes that component is vulnerable