PT-2006-4335 · Microsoft · Internet Explorer

Sam Thomas · Publicado 2006-08-08 · Atualizado 2021-07-23 · CVE-2006-3450

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6

Description A remote code execution issue exists due to the way Internet Explorer interprets HTML with certain layout positioning combinations. An attacker could exploit this by constructing a specially crafted Web page, potentially allowing remote code execution if a user views the page. Successful exploitation could give an attacker complete control of the affected system. The issue involves the use of the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements.

Recommendations For Microsoft Internet Explorer version 6, consider avoiding the use of the document.getElementByID Javascript function to access crafted CSS elements until a fix is available. Restrict access to specially crafted Web pages to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-3450

Produtos afetados

Internet Explorer

Referências · 17

• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:433 · Nota
• http://securitytracker.com/id?1016663 · Nota
• http://frsirt.com/english/advisories/2006/3212 · Nota
• http://kb.cert.org/vuls/id/119180 · Correção
• http://zerodayinitiative.com/advisories/ZDI-06-027.html · Nota
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Correção
• http://securityfocus.com/archive/1/archive/1/442579/100/0/threaded · Nota
• http://securityfocus.com/archive/1/442579/100/0/threaded · Nota
• http://securityfocus.com/bid/19312 · Correção
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042 · Aviso do Fabricante
• http://secunia.com/advisories/21396 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-042 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3450 · Nota de Segurança
• http://vupen.com/english/advisories/2006/3212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3450 · Nota de Segurança