漏洞描述
Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundation Class (MFC) Library 8.0, as used by the ListFiles method in hpqutil.dll 2.0.0.138 in Hewlett-Packard (HP) All-in-One and Photo & Imaging Gallery 1.1 and probably other products, allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long first argument.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
goodfellas.shellcode.com.arhttp://goodfellas.shellcode.com.ar/own/VULWAR200706041↗securityreason.comhttp://securityreason.com/securityalert/3143↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/611008↗secunia.comhttp://secunia.com/advisories/26800↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/479443/100/0/threaded↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/36609↗goodfellas.shellcode.com.arhttp://goodfellas.shellcode.com.ar/own/VULWKU200706142↗www.securityfocus.comhttp://www.securityfocus.com/bid/25673↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/36608↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/479442/100/0/threaded↗www.vupen.comhttp://www.vupen.com/english/advisories/2007/3182↗www.securityfocus.comhttp://www.securityfocus.com/bid/25697↗www.securitytracker.comhttp://www.securitytracker.com/id?1018698↗