A certain ActiveX control in sapi.dll (aka the Speech API)...
Vulnerability Description
A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-0675
Credits & Attribution
No credits recorded in the NVD database.
References
- http://blogs.technet.com/msrc/archive/2007/01/31/issue-regarding-windows-vista-speech-recognition.aspx
- http://secunia.com/advisories/30578
- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004012.html
- http://www.securityfocus.com/bid/22359
- http://www.us-cert.gov/cas/techalerts/TA08-162B.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5489
- http://marc.info/?l=bugtraq&m=121380194923597&w=2
- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004007.html
- http://marc.info/?l=bugtraq&m=121380194923597&w=2
- http://www.securitytracker.com/id?1020232
- http://www.vupen.com/english/advisories/2008/1779/references
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-032
- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004003.html
- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004005.html
More from microsoft
View All →Affected Vendor
microsoft
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.