critical9.3Public exploit code

CVE-2007-6387

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intui…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow2007-12-31 · remote · windows · Verified

Impact

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

Affected products

Vendor	Product	Affected versions
Intuit	Bookkeeping	All versions
Intuit	Proseries	All versions
Intuit	Quickbooks	All versions
Intuit	Quicken	All versions
Intuit	Quicktax	All versions
Intuit	Turbo Tax	All versions
Microsoft	Activex	Version 4.0.0.42
Vantage Linquistics	Answerworks	All versions

Weakness classification

CWE-119

Public exploit code

Impact

Affected products

Weakness classification

References