« Volver al listado

CVE-2008-4255

Estado: ModificadaAlta (9.3)—

Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Microsoft — Office FrontpageMicrosoft — ProjectMicrosoft — Visual BasicMicrosoft — Visual FoxproMicrosoft — Visual Studio .net

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4255",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-12-10T14:00:00.970",
  "references": [
    {
      "url": "http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl",
      "tags": [
        "Exploit"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/499061/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/32613",
      "tags": [
        "Patch"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1021369",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/3382",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-083",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-083/",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6032",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/499061/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32613",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1021369",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/3382",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-083",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-083/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6032",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an \"allocation error\" and memory corruption, aka \"Windows Common AVI Parsing Overflow Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de búfer en la región heap de la memoria en el archivo mscomct2.ocx (también se conoce como control ActiveX de Windows Common o control ActiveX de Microsoft Animation) en Visual Basic versión  6.0, Visual Studio .NET 2002 SP1 y 2003 SP1, Visual FoxPro versiones 8.0 SP1 y 9.0 SP1 y SP2, y Office Project 2003 SP3 y 2007 Gold y SP1, de Microsoft,  permite a atacantes remotos ejecutar código arbitrario por medio de un archivo AVI con una longitud de secuencia diseñada, lo que desencadena un \"allocation error\"  y corrupción de memoria, también se conoce como \"Windows Common AVI Parsing Overflow Vulnerability.\""
    }
  ],
  "lastModified": "2026-06-16T22:57:30.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office_frontpage:2002:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2D429D9-577E-4CD6-ADEC-1119B60DB20F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25881D4B-06E5-4083-AEEF-B6E1CE5C459A"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project:2007:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CD3B021-8145-49FA-8809-C3976ED1BE62"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project:2007:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "145E1D64-840B-4AE8-91CB-EA4884ED51D4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_basic:6.0:*:runtime_extended_files:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD65D7E8-016B-44EC-A416-E9247810CFF3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5DE8B76-FA09-4EA2-9535-758C56C4C099"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "478347F8-6256-4DE6-AD6A-91631A9E6DD1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E711CC3-9094-4C54-A794-9C7A3E7F4AFA"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "747E3E3A-85C1-4E55-B7F8-C5207F247498"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85959AEB-2FE5-4A25-B298-F8223CE260D6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}