CERT-In Vulnerability Note
CIVN-2007-0159
Microsoft Jet Database Engine MDB File Parsing Remote Buffer Overflow Vulnerability
Original Issue Date:December 19, 2007
Updated: May 24, 2010
Severity Rating: HIGH
Systems Affected
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP SP2
- Windows XP Professional x64 Edition
- Windows Server 2003 Service Pack 1
- Windows Server 2003 x64 Edition
- Windows Server 2003 with SPI for Itanium-based Systems
Component Affected
- Microsoft Jet 4.0 Database Engine
Overview
A vulnerability has been reported in Microsoft Jet Database Engine MDB File. This vulnerability could be exploited by a remote attacker to execute arbitrary code via malformed .mdb database file and take control of the compromise system in the context of logged in user.
Description
A Stack-based buffer overflow vulnerability exists in Microsoft Jet Database Engine caused by improper validation while handling MDB msjet40.dll File. This vulnerability could be exploited by remote attacker via specially crafted .mdb database file. An attacker could host a web site containing this specially crafted file or send it via Email attachment and entice user to open the same .
Opening this file may result in execution of arbitrary code. Authentication is not required to exploit this vulnerability. Successful exploitation of this vulnerability would allow remote attacker to execute arbitrary code on the victims system with the privileges of the victim or possibly crash application causing Denial of service.
Workaround
Do not open attachments from unsolicited email messages
Block high-risk file attachments at email gateways
Restrict the Microsoft Jet Database Engine from running
Block MDB files from being processed through mail infrastructure
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS08-028
Vendor Information
Microsoft
http://support.microsoft.com/kb/925330
http://www.microsoft.com/technet/security/advisory/950627.mspx
References
DVLabs
http://dvlabs.tippingpoint.com/advisory/TPTI-08-04
US-CERT
http://www.kb.cert.org/vuls/id/936529
SecurityTracker
http://securitytracker.com/alerts/2007/Nov/1018976.html
http://www.securitytracker.com/alerts/2008/Mar/1019686.html
Security Focus
http://www.securityfocus.com/bid/26468/discuss
http://www.securityfocus.com/bid/26468
X-Force
http://xforce.iss.net/xforce/xfdb/38499
McAfee
http://vil.nai.com/vil/content/v_vul35540.htm
CVE Name
CVE-2007-6026
CVE-2007-6357
CVE-2008-1200
CVE-2008-1092
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|