CVE-2007-6387

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 38%

exploitation probability

38%top 2% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/4825unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/26566 http://secunia.com/advisories/26670 https://exchange.xforce.ibmcloud.com/vulnerabilities/39004 http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx https://www.exploit-db.com/exploits/4825 http://www.intuit.com/support/security/http://www.securityfocus.com/bid/26815 http://www.vantagelinguistics.com/answerworks/release/http://www.vupen.com/english/advisories/2007/4194 http://www.vupen.com/english/advisories/2007/4195