Lucene search

MitreCVE-2006-5559

HistoryOct 27, 2006 - 4:07 p.m.

CVE-2006-5559

2006-10-2716:07:00

CWE-20

mitre

web.nvd.nist.gov

cve-2006-5559

execute method

adodb.connection

activex control

microsoft data access components

mdac

denial of service

arbitrary code

remote attackers

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

High

EPSS

0.968

Percentile

99.7%

JSON

The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.

Affected configurations

Nvd

Node

microsoftwindows_2000sp4

AND

microsoftdata_access_componentsMatch2.5sp3

Node

microsoftwindows_xpsp2

AND

microsoftdata_access_componentsMatch2.8sp1

Node

microsoftwindows_2003_server

microsoftwindows_2003_serverMatchitanium

AND

microsoftdata_access_componentsMatch2.8

Node

microsoftwindows_2000sp4

AND

microsoftdata_access_componentsMatch2.7sp1

Node

microsoftwindows_2000sp4

AND

microsoftdata_access_componentsMatch2.8

Node

microsoftwindows_2000sp4

AND

microsoftdata_access_componentsMatch2.8sp1

VendorProductVersionCPE
microsoftwindows_2000*cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoftdata_access_components2.5cpe:2.3:a:microsoft:data_access_components:2.5:sp3:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoftdata_access_components2.8cpe:2.3:a:microsoft:data_access_components:2.8:sp1:*:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
microsoftwindows_2003_serveritaniumcpe:2.3:o:microsoft:windows_2003_server:itanium:*:*:*:*:*:*:*
microsoftdata_access_components2.8cpe:2.3:a:microsoft:data_access_components:2.8:*:*:*:*:*:*:*
microsoftdata_access_components2.7cpe:2.3:a:microsoft:data_access_components:2.7:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_2000	*	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
microsoft	data_access_components	2.5	cpe:2.3:a:microsoft:data_access_components:2.5:sp3::::::
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
microsoft	data_access_components	2.8	cpe:2.3:a:microsoft:data_access_components:2.8:sp1::::::
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::::::::
microsoft	windows_2003_server	itanium	cpe:2.3:o:microsoft:windows_2003_server:itanium:::::::*
microsoft	data_access_components	2.8	cpe:2.3:a:microsoft:data_access_components:2.8:::::::*
microsoft	data_access_components	2.7	cpe:2.3:a:microsoft:data_access_components:2.7:sp1::::::