Microsoft Windows Win32 API buffer overflow [CVE-2007-2219]

VulDB: Microsoft Windows Win32 API buffer overflow [CVE-2007-2219]

General

Microsoft

scipID: 3128
Affected: Microsoft Windows
Published: 06/12/2007 (Billy Rios)
Risk: critical
Entry: 98.7% complete
Created: 06/18/2007
Updated: 09/03/2012

Summary

A vulnerability, which was classified as critical, has been found in Microsoft Windows. Affected by this issue is an unknown function of the component Win32 API. The manipulation with an unknown input leads to a buffer overflow vulnerability. Impacted is confidentiality, integrity, and availability.

The weakness was presented 06/12/2007 by Billy Rios with VeriSign as MS07-035. The advisory is shared for download at microsoft.com. This vulnerability is handled as CVE-2007-2219 since 04/24/2007. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 25488, which helps to determine the existence of the flaw in a target environment. It is running in the context local and relying on port 139.

The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (35341), Secunia (SA25640), SecurityFocus (BID 24370) and SecurityTracker (ID 1018230).