Vulnerability Description
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 2000 | All versions |
| Microsoft | Data Access Components | 2.5 |
| Microsoft | Windows Xp | All versions |
| Microsoft | Windows 2003 Server | All versions |
Related Weaknesses (CWE)
References
- http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.
- http://research.eeye.com/html/alerts/zeroday/20061027.htmlPatch
- http://secunia.com/advisories/22452Vendor Advisory
- http://securitytracker.com/id?1017127ExploitPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/589272PatchUS Government Resource
- http://www.osvdb.org/31882
- http://www.securityfocus.com/bid/20704ExploitPatch
- http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/0578Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-00
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29837
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.
- http://research.eeye.com/html/alerts/zeroday/20061027.htmlPatch
- http://secunia.com/advisories/22452Vendor Advisory
FAQ
What is CVE-2006-5559?
CVE-2006-5559 is a vulnerability with a CVSS score of 9.3 (HIGH). The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and...
How severe is CVE-2006-5559?
CVE-2006-5559 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-5559?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows 2000, Microsoft Data Access Components, Microsoft Windows Xp, Microsoft Windows 2003 Server.