Vulnerability Name:

CVE-2007-0842 (CCN-32454)

Assigned:2007-02-12
Published:2007-02-12
Updated:2018-10-16
Summary:The 64-bit versions of Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) time functions, including (1) localtime, (2) localtime_s, (3) gmtime, (4) gmtime_s, (5) ctime, (6) ctime_s, (7) wctime, (8) wctime_s, and (9) fstat, trigger an assertion error instead of a NULL pointer or EINVAL when processing a time argument later than Jan 1, 3000, which might allow context-dependent attackers to cause a denial of service (application exit) via large time values.
Note: it could be argued that this is a design limitation of the functions, and the vulnerability lies with any application that does not validate arguments to these functions. However, this behavior is inconsistent with documentation, which does not list assertions as a possible result of an error condition.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
4.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:U/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
4.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:U/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: CCN
Type: Full-Disclosure Mailing List, Mon Feb 12 2007 - 16:46:42 CST
SecurityVulns.com: Microsoft Visual C++ 8.0 standard library time functions invalid assertion DoS (Problem 3000).

Source: MITRE
Type: CNA
CVE-2007-0842

Source: MISC
Type: UNKNOWN
http://msdn2.microsoft.com/en-us/library/a442x3ye(VS.80).aspx

Source: CCN
Type: Microsoft Visual C++ Web site
Visual C++ Developer Center

Source: OSVDB
Type: UNKNOWN
33626

Source: SREASON
Type: Exploit
2237

Source: CCN
Type: OSVDB ID: 33626
Microsoft Visual C++ MSVCR80.DLL Time Functions Assertion Error

Source: BUGTRAQ
Type: UNKNOWN
20070212 SecurityVulns.com: Microsoft Visual C++ 8.0 standard library time functions invalid assertion DoS (Problem 3000).

Source: XF
Type: UNKNOWN
visualstudio-time-dos(32454)

Source: XF
Type: UNKNOWN
visualstudio-time-dos(32454)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:visual_c++:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2005:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:visual_studio:2005:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_c++:8.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft visual c++ 8.0
    microsoft visual studio 2005
    microsoft visual studio 2005
    microsoft visual c++ 8.0