PT-2006-3074 · Microsoft · Activex+3

Jesse Ruderman · Publicado 2006-04-29 · Atualizado 2021-07-23 · CVE-2006-2094

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions prior to Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1

Description The issue allows remote attackers to construct a race condition, tricking a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing an ActiveX control. This occurs when the Prompt is configured in Security Settings, and modal dialogs are used to verify user intentions.

Recommendations For Microsoft Internet Explorer versions prior to Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, update to Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 to resolve the issue.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2006-2094

Produtos afetados

Activex

Internet Explorer

Windows Server 2003

Windows Xp

Referências · 13

• 🔥 https://exploit-db.com/exploits/27744 · Exploit
• 🔥 http://securityfocus.com/bid/17713 · Exploit
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045589.html · Nota
• http://securitytracker.com/id?1015720 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0759.html · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0019.html · Nota
• http://student.missouristate.edu/m/matthew007/advisories.asp?adv=2006-02 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1559 · Aviso do Fabricante
• http://osvdb.org/22351 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26111 · Nota
• http://squarefree.com/2004/07/01/race-conditions-in-security-dialogs · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0264.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2094 · Nota de Segurança