PT-2006-2368 · Microsoft · Internet Explorer

Andreas Sandblad · Publicado 2006-03-22 · Atualizado 2021-07-23 · CVE-2006-1359

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 7 Beta 2

Description A remote code execution issue exists due to the way Internet Explorer handles certain method calls to HTML objects, potentially corrupting system memory and allowing an attacker to execute arbitrary code if a user visits a malicious website. This could result in an attacker taking complete control of an affected system.

Recommendations For Microsoft Internet Explorer versions 6 through 7 Beta 2, consider disabling the createTextRange call on checkbox objects as a temporary workaround until a patch is available. Restrict access to malicious websites to minimize the risk of exploitation.

Exploit

Correção

DoS

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-1359

Produtos afetados

Internet Explorer

Referências · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_013_createtextrange.rb · Exploit
• 🔥 https://exploit-db.com/exploits/1838 · Exploit
• 🔥 https://exploit-db.com/exploits/1606 · Exploit
• 🔥 https://exploit-db.com/exploits/1620 · Exploit
• 🔥 https://exploit-db.com/exploits/1628 · Exploit
• 🔥 https://exploit-db.com/exploits/16578 · Exploit
• 🔥 http://securityfocus.com/bid/17196 · Exploit
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1178 · Nota
• http://xforce.iss.net/xforce/xfdb/25379 · Nota
• http://securityfocus.com/archive/1/428583/100/0/threaded · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1427.html · Nota
• http://secunia.com/secunia_research/2006-7/advisory · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1359 · Nota de Segurança
• http://microsoft.com/technet/security/advisory/917077.mspx · Nota
• http://vupen.com/english/advisories/2006/1050 · Nota