Vulnerability CVE-2007-6387


Published: 2007-12-14   Modified: 2017-09-28

Description:
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

Vendor: Microsoft
Product: Activex 
Version: 4.0.0.42;
Vendor: Intuit
Product: Bookkeeping 
Product: Proseries 
Product: Quickbooks 
Product: Quicken 
Product: Quicktax 
Product: Turbo tax 
Vendor: Vantage linquistics
Product: Answerworks 

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx
http://www.intuit.com/support/security/
http://www.securityfocus.com/bid/26815
http://www.vantagelinguistics.com/answerworks/release/
http://www.vupen.com/english/advisories/2007/4194
http://www.vupen.com/english/advisories/2007/4195
https://exchange.xforce.ibmcloud.com/vulnerabilities/39004
https://www.exploit-db.com/exploits/4825

Copyright 2017, cxsecurity.com

 

Back to Top