PT-2006-4333 · Microsoft · Windows 2000+4

Publicado 2006-11-14 · Atualizado 2018-10-18 · CVE-2006-3445

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Agent versions on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1

Description The issue arises from an integer overflow in the ReadWideString function within agentdpv.dll, allowing remote attackers to execute arbitrary code via a large length value in an .ACF file. This results in a heap-based buffer overflow. An attacker could exploit this by constructing a specially crafted Web page, potentially allowing remote code execution if a user views the page, and could take complete control of the affected system.

Recommendations For Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2006-3445

Produtos afetados

Agent

Windows

Windows 2000

Windows Server 2003

Windows Xp

Referências · 17

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A154 · Nota
• http://xforce.iss.net/xforce/xfdb/29945 · Nota
• http://coseinc.com/alert.html · Nota
• http://secunia.com/advisories/22878 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-068 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3445 · Nota de Segurança
• http://kb.cert.org/vuls/id/810772 · Nota
• http://securitytracker.com/id?1017222 · Nota
• http://securityfocus.com/archive/1/458558/100/0/threaded · Nota
• http://us-cert.gov/cas/techalerts/TA06-318A.html · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-068 · Nota
• http://securityfocus.com/archive/1/archive/1/458558/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29945 · Nota
• http://frsirt.com/english/advisories/2006/4506 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3445 · Nota de Segurança