CVE-2006-5559
57Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 42%
from disclosure to weapon0 days
Published on NVDOct 27
1st PoCOct 24
VulnCheck+1282d
exploitation probability
42%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/2629⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspxhttp://research.eeye.com/html/alerts/zeroday/20061027.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009http://secunia.com/advisories/22452http://securitytracker.com/id?1017127https://exchange.xforce.ibmcloud.com/vulnerabilities/29837https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A214http://www.kb.cert.org/vuls/id/589272http://www.osvdb.org/31882http://www.securityfocus.com/bid/20704http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlhttp://www.vupen.com/english/advisories/2007/0578