CVEvulnerability
CVE-2006-5559
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-10-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.
Affected configurations
• microsoft data access components 2.5
• microsoft data access components 2.8
• microsoft data access components 2.7
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx blogs.technet.com
- http://research.eeye.com/html/alerts/zeroday/20061027.html Patch
- http://secunia.com/advisories/22452 Vendor Advisory
- http://securitytracker.com/id?1017127 Exploit, Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/589272 Patch, US Government Resource
- http://www.osvdb.org/31882 www.osvdb.org
- http://www.securityfocus.com/bid/20704 Exploit, Patch
- http://www.us-cert.gov/cas/techalerts/TA07-044A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/0578 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29837 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A214 oval.cisecurity.org
- http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx blogs.technet.com
- http://research.eeye.com/html/alerts/zeroday/20061027.html Patch
- http://secunia.com/advisories/22452 Vendor Advisory
- http://securitytracker.com/id?1017127 Exploit, Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/589272 Patch, US Government Resource
- http://www.osvdb.org/31882 www.osvdb.org
- http://www.securityfocus.com/bid/20704 Exploit, Patch
- http://www.us-cert.gov/cas/techalerts/TA07-044A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/0578 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29837 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A214 oval.cisecurity.org