Login Request a demo
Unscored severity · published Oct 27, 2006
CVE-2006-5559
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5…
–
CVSS
43.6%
EPSS
No
On KEV
Description
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.
Exploitation
Is it being used?
Exploit prediction (EPSS)43.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Data Access Components · Microsoft
2.5; 2.8; 2.8; 2.7; 2.8; 2.8 · source: NVD
Affected product
DA
Data Access Components
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5559
blogs.technet.com
http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx
Patch
http://research.eeye.com/html/alerts/zeroday/20061027.html
Vendor Advisory
http://secunia.com/advisories/22452
Exploit
http://securitytracker.com/id?1017127
Patch
http://www.kb.cert.org/vuls/id/589272
www.osvdb.org
http://www.osvdb.org/31882
More from Data Access Components
9.8
CVE-2012-1891
Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary…
–
CVE-2011-0027
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures,…
–
CVE-2011-0026
Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components…
–
CVE-2006-0003
Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and…
–
CVE-2003-0903
Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a…