Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

The remote host is missing a list of kill bits for ActiveX controls that are known to contain vulnerabilities. 

If these ActiveX controls are ever installed on the remote host, either now or in the future, they would expose it to various security issues.

The remote host contains a version of the ActiveX control for Visual Basic 6.0 Runtime Extended Files that may allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.

Note that this control may have been included with Visual Studio or FoxPro or as part of a third-party application created by one of those products.

ID	Name	Product	Family	Severity
35634	MS KB960715: Cumulative Security Update of ActiveX Kill Bits	Nessus	Windows	medium
35069	MS08-070: Vulnerabilities in Visual Basic 6.0 ActiveX Controls Could Allow Remote Code Execution (932349)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2008-4255

high

Tenable Plugins

medium

high