HTTP: Microsoft RichEdit Allows Remote Code Execution

This signature detects attempts to exploit a known vulnerability in the Rich text format parser in Windows. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user application.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that occurs when the application attempts to parse malformed Rich Text Files (RTF). An attacker could exploit this issue by enticing a victim to load a malicious RTF file. If the vulnerability is successfully exploited, this could result in the execution of arbitrary code in the context of the currently logged-in user.

Affected Products

Avaya s8100_media_servers,Microsoft windows_2000_server

References

CVE: CVE-2007-0026

Short Name

HTTP:STC:DL:MS-RICHEDIT-RCE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft RichEdit Allows Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?