CVE-2007-4916
HP Photo and Imaging Gallery - Heap-Based Buffer Overflow via Long First Argument
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-4916. PoCs published by Jonathan Sarba, GOODFELLAS.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in the CFileFind::FindFile method in the MFC library, specifically via the 'hpqutil.dll' ActiveX control. It uses a VBScript to trigger the overflow by passing a long string of 'A' characters to the ListFiles method.
Description
Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundation Class (MFC) Library 8.0, as used by the ListFiles method in hpqutil.dll 2.0.0.138 in Hewlett-Packard (HP) All-in-One and Photo & Imaging Gallery 1.1 and probably other products, allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long first argument.
Exploits (2)
This exploit targets a buffer overflow vulnerability in the CFileFind::FindFile method in the MFC library, specifically via the 'hpqutil.dll' ActiveX control. It uses a VBScript to trigger the overflow by passing a long string of 'A' characters to the ListFiles method.
This exploit demonstrates a heap overflow vulnerability in HP's hpqutil.dll (version 2.0.0.138) due to an unsafe lstrcpyA call in the ListFiles function. The PoC triggers the overflow by passing a long string (620 'A's) to the ActiveX control, leading to a crash or potential remote code execution.