Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: Flaw in MFC42 and MFC71 findfile() function - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Flaw in MFC42 and MFC71 findfile() function

A few readers brought it to our attention that a new 0-day vulnerability related to Windows platform has been published. The vulnerability is in the native libraries of Windows MFC42 and MFC71. The function CFileFind::FindFile() in MFC library is lacking in validation, when function argument is an overly long string, a heap overflow condition can result.

The effect of this vulnerability would be dependent on the application calling the function, some applications are easier to exploit than others. It is unknown at this point what major applications are affected by this vulnerability.

Please refer to this article for more details

Jason

93 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!