CVE-2007-6387

2007-12-1502:46:00

CWE-119

mitre

web.nvd.nist.gov

cve-2007-6387

buffer overflow

stack-based overflow

awapi4.answerworks.1

activex control

vantage linguistics

intuit

remote code execution

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.8

Confidence

Low

EPSS

0.641

Percentile

97.9%

JSON

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

intuitbookkeeping

intuitproseries

intuitquickbooks

intuitquicken

intuitquicktax

intuitturbo_tax

microsoftactivexMatch4.0.0.42

vantage_linquisticsanswerworks

VendorProductVersionCPE
intuitbookkeeping*cpe:2.3:a:intuit:bookkeeping:*:*:*:*:*:*:*:*
intuitproseries*cpe:2.3:a:intuit:proseries:*:*:*:*:*:*:*:*
intuitquickbooks*cpe:2.3:a:intuit:quickbooks:*:*:*:*:*:*:*:*
intuitquicken*cpe:2.3:a:intuit:quicken:*:*:*:*:*:*:*:*
intuitquicktax*cpe:2.3:a:intuit:quicktax:*:*:*:*:*:*:*:*
intuitturbo_tax*cpe:2.3:a:intuit:turbo_tax:*:*:*:*:*:*:*:*
microsoftactivex4.0.0.42cpe:2.3:a:microsoft:activex:4.0.0.42:*:*:*:*:*:*:*
vantage_linquisticsanswerworks*cpe:2.3:a:vantage_linquistics:answerworks:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
intuit	bookkeeping	*	cpe:2.3:a:intuit:bookkeeping::::::::
intuit	proseries	*	cpe:2.3:a:intuit:proseries::::::::
intuit	quickbooks	*	cpe:2.3:a:intuit:quickbooks::::::::
intuit	quicken	*	cpe:2.3:a:intuit:quicken::::::::
intuit	quicktax	*	cpe:2.3:a:intuit:quicktax::::::::
intuit	turbo_tax	*	cpe:2.3:a:intuit:turbo_tax::::::::
microsoft	activex	4.0.0.42	cpe:2.3:a:microsoft:activex:4.0.0.42:::::::*
vantage_linquistics	answerworks	*	cpe:2.3:a:vantage_linquistics:answerworks::::::::