CVE-2008-3704
EXPLOITED IN THE WILDMicrosoft Visual Studio <6.0.84.18 - Buffer Overflow
Title source: llmExploitation Summary
CVE-2008-3704 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 4 public exploits from researchers including Metasploit, Koshi, Symantec, including a Metasploit module exploits/windows/browser/ms08_070_visual_studio_msmask.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in the Msmask32.ocx ActiveX control in Microsoft Visual Studio 6.0. It delivers a malicious HTML page with JavaScript that triggers the vulnerability via a crafted 'Mask' parameter, leading to arbitrary code execution.
Description
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Exploits (4)
This exploit targets a stack buffer overflow in the Msmask32.ocx ActiveX control in Microsoft Visual Studio 6.0. It delivers a malicious HTML page with JavaScript that triggers the vulnerability via a crafted 'Mask' parameter, leading to arbitrary code execution.
This exploit targets a buffer overflow vulnerability in the MSMASK32.OCX ActiveX control (CVE-2008-3704) by crafting a malicious 'Mask' parameter to trigger arbitrary code execution. It uses heap spraying and shellcode (Alpha2-encoded) to spawn a calculator (calc.exe) as a proof-of-concept.
This exploit targets a buffer overflow vulnerability in the Microsoft DirectShow 'Mask' parameter. It uses a long string of unescaped characters to trigger the overflow, potentially leading to arbitrary code execution.
This Metasploit module exploits a stack buffer overflow in Microsoft Visual Studio 6.0's Mdmask32.ocx ActiveX control via a crafted 'Mask' parameter. It delivers a reverse TCP shell payload through a malicious HTML page with obfuscated JavaScript.