Description
Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic project (vbp) file containing a long Reference line, related to VBP_Open and OLE. NOTE: there are limited usage scenarios under which this would be a vulnerability.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Microsoft Visual Basic VBP Stack Buffer Overflow
exploit/windows/fileformat/ms_visual_basic_vbp
Exploit-DB 3
- Microsoft Visual Basic - '.VBP' Local Buffer Overflow (Metasploit) EDB-16680 · local · Sep 25, 2010 · verified
- Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution EDB-4431 · local · Sep 19, 2007 · verified
- Microsoft Visual Basic 6.0 - VBP_Open OLE Local CodeExec EDB-4361 · local · Sep 4, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.