Microsoft looks into Visual Studio bug

Microsoft is investigating a reported zero-day vulnerability that impacts Visual Studio 6, an older model of the software giant's developer tools suite.

The flaw is caused by a "Masked Edit" ActiveX control error that can be exploited to cause a stack-based buffer overflow, according to vulnerability tracking firm Secunia, which assigned a "highly critical" rating to the bug.

Users can be infected with malicious code if they visit a specially crafted rogue website that "initializes the object with an overly long 'Mask' parameter," a Secunia advisory said.

Microsoft Visual Studio 6 Enterprise, Professional and Standard editions are vulnerable, although other versions may be affected, the advisory said.

Visual Studio 6 was last updated June 2000, a Microsoft spokeswoman told SCMagazineUS.com on Friday. The version is no longer supported.

Visual Studio 2008 is the latest release, she said. The company encourages users to update to the newest version.

The flaw was reported by Symantec, according to a French Security Incident Response Team advisory.

See original article on scmagazineus.com