Vulnerability CVE-2007-6387
Published: 2007-12-14   Modified: 2012-02-12

Description:
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Vantage linquistics -> Answerworks 
Microsoft -> Activex 
Intuit -> Bookkeeping 
Intuit -> Proseries 
Intuit -> Quickbooks 
Intuit -> Quicken 
Intuit -> Quicktax 
Intuit -> Turbo tax 

 References:
http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx
http://www.intuit.com/support/security/
http://www.securityfocus.com/bid/26815
http://www.vantagelinguistics.com/answerworks/release/
http://www.vupen.com/english/advisories/2007/4194
http://www.vupen.com/english/advisories/2007/4195
https://exchange.xforce.ibmcloud.com/vulnerabilities/39004
https://www.exploit-db.com/exploits/4825
Copyright 2024, cxsecurity.com

 

Back to Top