CVE-2007-2216
Internet Explorer 5.01, 6 SP1, and 7 - Remote Code Execution via tblinf32.dll ActiveX Control
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-2216. PoCs published by Brett Moore.
AI-analyzed exploit summary This exploit leverages a vulnerability in the Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX control to execute arbitrary code by enticing a victim to open a maliciously crafted HTML document. The PoC demonstrates how to call a remote DLL's GetDocumentation function via the TypeLibInfoFromFile method.
Description
The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability."
Exploits (1)
This exploit leverages a vulnerability in the Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX control to execute arbitrary code by enticing a victim to open a maliciously crafted HTML document. The PoC demonstrates how to call a remote DLL's GetDocumentation function via the TypeLibInfoFromFile method.