Description
Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundation Class (MFC) Library 8.0, as used by the ListFiles method in hpqutil.dll 2.0.0.138 in Hewlett-Packard (HP) All-in-One and Photo & Imaging Gallery 1.1 and probably other products, allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long first argument.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- HP - ActiveX 'hpqutil.dll' ListFiles Remote Heap Overflow (PoC) EDB-4409 · dos · Sep 14, 2007 · verified
- Microsoft MFC Library - CFileFind::FindFile Buffer Overflow EDB-30593 · dos · Sep 14, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 25697 vdb-entry
- 20070914 [GOODFELLAS-VULN] ActiveX hpqutil!ListFiles hpqutil.dll - Remoteheap overflow mailing-list
- 20070914 [GOODFELLAS-VULN] FileFind class from MFC Library cause heapoverflow mailing-list
- 1018698 vdb-entry
- visual-mfc-findfile-bo(36608) vdb-entry
- 25673 vdb-entry
- VU#611008 third-party-advisory
- http://goodfellas.shellcode.com.ar/own/VULWKU200706142
- http://goodfellas.shellcode.com.ar/own/VULWAR200706041
- 3143 third-party-advisory
- 26800 third-party-advisory
- ADV-2007-3182 vdb-entry
- hp-hpqutillistfiles-bo(36609) vdb-entry