Visual Studio VB T-SQL Object Contains Unchecked Buffer

A security vulnerability exists in Microsoft Visual Basic 6.0 which could allow a malicious user to exploit a buffer overrun to run code of the attacker's choice on the hosting machine.

Issue

The VB T-SQL debugger object that ships with Visual Studio 6.0 or Visual Basic 6.0 Enterprise Edition has an unchecked buffer in the code that processes parameters for one of the object’s methods. The object can, by design, be programmatically accessed remotely. If the object were to be referenced by a program that contained specially malformed data within the parameter, either of two outcomes would result. In the less serious case, the attacker could cause the object to fail on the hosting machine. In the more serious case, the attacker could exploit the buffer overrun to run code of the attacker's choice on the hosting machine.

The debugger object (vbsdicli.exe) is installed by default with Visual Studio 6.0 or Visual Basic 6.0 Enterprise Edition and runs in the context of the interactively logged-on user. The attacker could only execute a successful attack if he knew that a user had the component installed and that the user was logged in at the time of the attack.

Affected Products

• Microsoft Visual Basic 6.0

Download

Patch: http://msdn.microsoft.com/vstudio/downloads/debugging/default.asp

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: March 27, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<