Intrusion PreventionMS.JET.Database.File.Code.Execution
Description
This indicates a possible exploit of a buffer overflow vulnerability in the Microsoft JET database engine.
The Jet Database Engine (Msjet40.dll) is a relational database engine that handles database processing for Microsoft office applications. A buffer overflow vulnerability is reported in it that may allow an attacker to execute arbitrary code on vulnerable client systems. This is possible because the Jet engine (msjetoledb40.dll) fails to properly validate data in .mdb files while parsing them. An attacker may a send malformed .mdb file to a victim via email or web link. Once the malformed database file is opened, arbitrary code embedded in it will be able to run on the exploited system leading to unauthorized access. User interaction may be required to open the .mdb file from web browser software.
Affected Products
Microsoft JET 4.0 SP7 and earlier versions.
Impact
System compromise: remote code execution.
Recommended Actions
Apply the appropriate patch from the vendor or upgrade to a non-vulnerable version if available.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2019-11-22 | 15.729 | Name:MS. Jet. DB. File. Code. Execution:MS. JET. Database. File. Code. Execution |
| ID | 11021 |
| Created | Oct 03, 2005 |
| Updated | Nov 15, 2021 |
| Risk |
|
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |