Buffer overflow in Microsoft Intelligent Application Gateway 2007
CVE-2007-2238
Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2, allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2) UpdateComponents methods.
Vulnerability class: Buffer Overflow
EPSS: 0.455 (98.7th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Intelligent_application_gateway_2007
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cret@cert.org (vdb-entry, x_refsource_VUPEN)
- cret@cert.org (x_refsource_SECUNIA, third-party-advisory)
- cret@cert.org (Patch, vdb-entry, x_refsource_BID)
- cret@cert.org (vdb-entry, x_refsource_XF)
Frequently asked questions
- What is CVE-2007-2238?
- CVE-2007-2238 is a vulnerability in Microsoft Intelligent Application Gateway 2007, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2009-04-16.
- Is CVE-2007-2238 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.