PT-2005-2224 · Microsoft · Internet Explorer+1

Peter Winter-Smith · Publicado 2005-06-14 · Atualizado 2018-10-12 · CVE-2005-1208

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to XP SP3 and Server 2003 SP2

Description The issue is caused by an integer overflow in Microsoft Windows, allowing remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file. This can be triggered by a large size field that causes a heap-based buffer overflow. The vulnerability can be exploited using a "ms-its:" URL in Internet Explorer.

Recommendations For Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier, update to a newer version to mitigate the risk. For versions prior to XP SP3, apply the necessary patches or updates to resolve the issue. For Server 2003 SP2, ensure all security updates are applied to prevent exploitation.

Correção

Identificadores relacionados

CVE-2005-1208

Produtos afetados

Internet Explorer

Windows

Referências · 10

• http://us-cert.gov/cas/techalerts/TA05-165A.html · Correção
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A381 · Nota
• http://kb.cert.org/vuls/id/851869 · Correção
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A463 · Nota
• http://securityfocus.com/bid/13953 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1057 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1208 · Nota de Segurança
• http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0062.html · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-026 · Aviso do Fabricante
• http://secunia.com/advisories/15683 · Aviso do Fabricante