Vulnerability Note VU#539001

Microsoft Visual FoxPro fails to properly evaluate filenames before launching application

Overview

There is a vulnerability in Microsoft Visual FoxPro 6.0 that allows remote attackers to execute Visual FoxPro applications with the privileges of the victim user.

I. Description

Microsoft Visual FoxPro 6.0 contains an unspecified vulnerability that allows remote attackers to execute arbitrary Visual FoxPro applications on a victim's computer. The attacker's code would run with the privileges of the victim user. Successful exploitation of this vulnerability requires the presence of either Visual FoxPro 6.0 or its runtime components.

II. Impact

This vulnerability allows remote attackers to run malicious Visual FoxPro applications on affected systems.

III. Solution

Apply a patch

Microsoft has published Microsoft Security Bulletin MS02-049 to address this issue. For more information, please see

http://www.microsoft.com/technet/security/bulletin/MS02-049.asp

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	17-Sep-2002

References

http://www.microsoft.com/technet/security/bulletin/MS02-049.asp

Credit

This document is based upon information provided by Microsoft.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public:	2002-09-04
Date First Published:	2002-09-12
Date Last Updated:	2002-09-17
CERT Advisory:
CVE-ID(s):	CAN-2002-0696
NVD-ID(s):	CAN-2002-0696
US-CERT Technical Alerts:
Metric:	11.81
Document Revision:	4

If you have feedback, comments, or additional information about this vulnerability, please send us email.