PT-2004-1991 · Microsoft · Internet Explorer+1

John Heasman · Publicado 2004-10-21 · Atualizado 2020-12-09 · CVE-2004-0978

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 6

Description: A heap-based buffer overflow issue exists in the Hrtbeat.ocx (Heartbeat) ActiveX control. This issue can be exploited by remote attackers to execute arbitrary code when users visit specific online gaming sites associated with MSN. The exploitation is possible via the SetupData parameter.

Recommendations: For Internet Explorer versions 5.01 through 6, consider disabling the Hrtbeat.ocx (Heartbeat) ActiveX control as a temporary workaround until a patch is available. Restrict access to online gaming sites associated with MSN to minimize the risk of exploitation. Avoid using the SetupData parameter in the affected ActiveX control until the issue is resolved.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2004-0978

Produtos afetados

Hrtbeat.Ocx (Heartbeat) Activex Control

Internet Explorer

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/17714 · Nota
• http://marc.info/?l=bugtraq&m=110616221411579&w=2 · Nota
• http://kb.cert.org/vuls/id/673134 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0978 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038 · Aviso do Fabricante
• http://securityfocus.com/bid/11367 · Nota
• http://ngssoftware.com/advisories/heartbeatfull.txt · Nota