Vulnerability Name:

CVE-2008-4253 (CCN-46183)

Assigned:2008-12-09
Published:2008-12-09
Updated:2018-10-12
Summary:The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "FlexGrid Control Memory Corruption Vulnerability."
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:8.5 High (CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C)
6.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-399
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-4253

Source: CCN
Type: HP Security Bulletin HPSBST02394 SSRT080183 rev.1
Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-070 to MS08-077

Source: CCN
Type: SECTRACK ID: 1021369
Microsoft Visual Basic DataGrid/FlexGrid/Heirarchival FlexGrid/Windows Common/Charts ActiveX Controls Let Remote Users Execute Arbitrary Code

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm

Source: CCN
Type: ASA-2008-473
MS08-070 Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution (932349)

Source: CCN
Type: Microsoft Security Bulletin MS08-070
Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution (932349)

Source: BID
Type: UNKNOWN
32592

Source: CCN
Type: BID-32592
Microsoft FlexGrid ActiveX Control Memory Corruption Vulnerability

Source: SECTRACK
Type: UNKNOWN
1021369

Source: CERT
Type: US Government Resource
TA08-344A

Source: VUPEN
Type: UNKNOWN
ADV-2008-3382

Source: MS
Type: UNKNOWN
MS08-070

Source: XF
Type: UNKNOWN
visualbasic-flexgrid-code-execution(46183)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:5994

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:office_frontpage:2002:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:project:2003:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:project:2007:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:project:2007:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_basic:6.0:*:runtime_extended_files:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:project:2003:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_basic:6.0:*:runtime_extended_files:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:5994
    V
    		FlexGrid Control Memory Corruption Vulnerability
    2012-11-12
    BACK
    microsoft office frontpage 2002 sp3
    microsoft project 2003 sp3
    microsoft project 2007
    microsoft project 2007 sp1
    microsoft visual basic 6.0
    microsoft visual foxpro 8.0 sp1
    microsoft visual foxpro 9.0 sp1
    microsoft visual foxpro 9.0 sp2
    microsoft visual studio .net 2002 sp1
    microsoft visual studio .net 2003 sp1
    microsoft project 2003 sp3
    microsoft visual foxpro 8.0 sp1
    microsoft visual foxpro 9.0 sp1
    microsoft visual foxpro 9.0 sp2
    microsoft visual basic 6.0