Sploitus

Exploit for Microsoft Visual Studio PDWizard.ocx ActiveX vulnerability

saint Β· 2007-09-30

Exploit Code

MARKDOWN35 lines
## https://sploitus.com/exploit?id=SAINT:E0E8A703FD54F66F1CDAA94F34F2FB22
Added: 09/30/2007  
CVE: [CVE-2007-4891](<https://vulners.com/cve/CVE-2007-4891>)  
BID: [25638](<http://www.securityfocus.com/bid/25638>)  
OSVDB: [37106](<http://www.osvdb.org/37106>)  


### Background

Microsoft [Visual Studio](<http://msdn.microsoft.com/vstudio/>) is a product for facilitating software development on Windows operating systems. 

### Problem

ActiveX controls contained in the `**PDWizard.ocx**` file in Microsoft Visual Studio 6.0 expose the `**StartProcess**` method and other dangerous methods which could allow arbitrary command execution when a user loads a specially crafted web page. 

### Resolution

Set the kill bit for Class ID 0DDF3C0B-E692-11D1-AB06-00AA00BDD685 as described in [Microsoft Knowledge Base Article 240797](<http://support.microsoft.com/kb/240797>). 

### References

<http://secunia.com/advisories/26779>  


### Limitations

Exploit works on Microsoft Visual Basic 6.0 on Windows 2000 and Windows XP. 

Since this exploit uses TFTP, the SAINTexploit host must be able to bind to port 69/UDP. 

Exploit requires the PERL threads module to be installed on the SAINTexploit host. 

### Platforms

Windows