7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.153 Low
EPSS
Percentile
95.9%
A vulnerability in the Microsoft Jet database engine could allow a remote attacker to execute code of their choice on a vulnerable system.
The Microsoft Jet Database Engine (Jet) provides data access functionality to a number of other Microsoft and many third party applications. An input validation error in the way that the Jet engine library handles the database files used by Microsoft Access (.mdb
files) results in a vulnerability that could allow a remote attacker to execute code on a vulnerable system. In order to exploit this vulnerability, the attacker would need the ability to supply a specially crafted .mdb
file and coax or trick a user into opening it. The malicious .mdb
file could be supplied remotely by a number of methods including, but not limited to, a web page, an email message, or a shared network folder.
A remote, unauthenticated attacker with the ability to supply a specially crafted .mdb
file could execute code of their choice on a vulnerable system. The attacker-supplied code would be executed with the same privileges as the user context of the application using the Jet Database Engine.
The CERT/CC is currently unaware of a practical solution to this problem.
Workarounds
Avoid opening Microsoft Access Database (.mdb
) files from untrusted sources.
Javascript is disabled. Click here to view vendors.
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerability was originally reported by researchers at HexView.
This document was written by Chad R Dougherty.
CVE IDs: | CVE-2005-0944 |
---|---|
Severity Metric: | 4.28 Date Public: |