Overview
Microsoft Cryptographic API Component Object Model (CAPICOM) Certificates ActiveX control contains a vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code.
Description
The Microsoft Cryptographic API Component Object Model (CAPICOM) Certificates ActiveX control provides a method of encrypting data using Windows CryptoAPI functionality. A vulnerability exists in the way that the CAPICOM.Certificates control validates input. By convincing a user to visit a malicious web site, an attacker may be able to execute arbitrary code. |
Impact
A remote, unauthenticated attacker may be able to gain control of the system, execute arbitrary code, or access the system with escalated privileges. |
Solution
Apply an Update Microsoft has released updates in Microsoft Security Bulletin MS07-028 to address this issue. |
Workarounds |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported in Microsoft Security Bulletin MS07-028. Microsoft credits Chris Ries of VigilantMinds Inc. for reporting the vulnerability to them.
This document was written by Katie Steiner.
Other Information
| CVE IDs: | CVE-2007-0940 |
| Severity Metric: | 3.09 |
| Date Public: | 2007-05-08 |
| Date First Published: | 2007-05-08 |
| Date Last Updated: | 2007-08-14 18:00 UTC |
| Document Revision: | 18 |