Unscored severity · published Aug 18, 2008
CVE-2008-3704
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic…
–
CVSS
55.9%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)55.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VB
Visual Basic · Microsoft
6.0 · source: NVD
VF
Visual Foxpro · Microsoft
8.0; 9.0; 9.0 · source: NVD
VS
Visual Studio · Microsoft
6.0 · source: NVD
VS
Visual Studio .net · Microsoft
2002; 2003 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3704
Vendor Advisory
http://secunia.com/advisories/31498
support.avaya.com
http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
Exploit
http://www.securityfocus.com/bid/30674
www.securitytracker.com
http://www.securitytracker.com/id?1020710
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA08-344A.html
Vendor Advisory
http://www.vupen.com/english/advisories/2008/2380
More from Visual Basic
8.8
CVE-2012-1856
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
8.8
CVE-2012-0158
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
–
CVE-2008-4256
The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors…
–
CVE-2008-4255
Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1…
–
CVE-2008-4254
Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote…