Signature Detail

HTTP: Microsoft Data Access Components Cachesize Heap Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Data Access Components. A successful attack can lead to a heap overflow and arbitrary remote code execution within the context of the server.

Extended Description

Microsoft Data Access Components (MDAC) are prone to a heap-based buffer-overflow vulnerability because they fail to properly bounds-check user-supplied data. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions.

Affected Products

• Avaya CallPilot 4.0
• Avaya CallPilot 5.0
• Avaya Communication Server 1000 Telephony Manager 3.0
• Avaya Communication Server 1000 Telephony Manager 4.0
• Avaya Conferencing Standard Edition 6.0
• Avaya Conferencing Standard Edition 6.0 SP1
• Avaya Meeting Exchange - Client Registration Server
• Avaya Meeting Exchange - Recording Server
• Avaya Meeting Exchange - Streaming Server
• Avaya Meeting Exchange - Web Conferencing Server
• Avaya Meeting Exchange - Webportal
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server 5.2
• Microsoft Data Access Components (MDAC) 2.8
• Microsoft Data Access Components (MDAC) 2.8 SP1
• Microsoft Data Access Components (MDAC) 2.8 SP2
• Microsoft Windows Data Access Components 6.0

References

• BugTraq: 54308
• CVE: CVE-2012-1891