CVE-2007-4891: OS Command Injection

Published Sep 14, 2007

Updated

A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell.

Affected Software

2 affected components

Microsoft Visual Studio=6.0

Microsoft Visual Studio=6.0.0.9782

Event History

Sep 14, 2007

CVE Published

01:17 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4891?

CVE-2007-4891 is rated as critical due to its ability to allow remote attackers to execute arbitrary programs on the affected system.

How do I fix CVE-2007-4891?

To mitigate CVE-2007-4891, users should upgrade to a patched version of Microsoft Visual Studio that addresses this vulnerability.

What platforms are affected by CVE-2007-4891?

CVE-2007-4891 affects Microsoft Visual Studio versions 6.0 and 6.0.0.9782.

What are the potential impacts of CVE-2007-4891?

Exploitation of CVE-2007-4891 could lead to unauthorized program execution and potential compromise of sensitive data.

Is CVE-2007-4891 still a risk today?

Although CVE-2007-4891 was disclosed in 2007, systems running the affected versions of Visual Studio remain vulnerable if they have not been updated.