Description
Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer properties that cause insufficient memory allocation and trigger a buffer overflow, aka the "VML Buffer Overrun Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Microsoft Internet Explorer - VML Download and Execute (MS07-004) EDB-3148 · remote · Jan 17, 2007 · verified
- Microsoft Internet Explorer - VML Remote Buffer Overflow (MS07-004) EDB-3137 · remote · Jan 16, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2007-0129 vdb-entry
- MS07-004 vendor-advisory
- TA07-009A third-party-advisory
- 21930 vdb-entry
- VU#122084 third-party-advisory
- HPSBST02184 vendor-advisory
- oval:org.mitre.oval:def:1058 vdb-entry signature
- 23677 third-party-advisory
- 1017489 vdb-entry
- ie-vml-record-bo(31287) vdb-entry
- 20070116 MS07-004 VML Integer Overflow Exploit mailing-list
- ADV-2007-0105 vdb-entry
- 31250 vdb-entry
- 20070117 Re: MS07-004 VML Integer Overflow Exploit mailing-list
- 929969 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-009.htm
- 20070109 Microsoft Windows VML Element Integer Overflow Vulnerability third-party-advisory