PT-2006-4513 · Microsoft · Windows Management Console+4

H D Moore + 2 · Publicado 2006-08-08 · Atualizado 2021-07-23 · CVE-2006-3643

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 5.01 through 6 Microsoft Windows 2000 SP4

Description The issue allows remote authenticated users to execute arbitrary commands due to a cross-site scripting (XSS) vulnerability. This vulnerability could permit access to local HTML-embedded resource files in the Microsoft Management Console (MMC) library. A remote code execution vulnerability in the Windows Management Console could allow an attacker to take complete control of the affected system.

Recommendations For Internet Explorer versions 5.01 through 6, update to a version that is not affected by this issue. For Microsoft Windows 2000 SP4, consider restricting access to the Microsoft Management Console (MMC) library until a patch is available. As a temporary workaround, consider disabling the execution of arbitrary commands in the MMC library to minimize the risk of exploitation.

Correção

RCE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-3643

Produtos afetados

Internet Explorer

Management Console

Windows

Windows 2000

Windows Management Console

Referências · 15

• https://nvd.nist.gov/vuln/detail/CVE-2006-3643 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A638 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28005 · Nota
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Correção
• http://securitytracker.com/id?1016655 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-044 · Aviso do Fabricante
• http://secunia.com/advisories/21401 · Nota
• http://frsirt.com/english/advisories/2006/3213 · Nota
• http://vupen.com/english/advisories/2006/3213 · Nota
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:638 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-044 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3643 · Nota de Segurança
• http://kb.cert.org/vuls/id/927548 · Correção
• http://xforce.iss.net/xforce/xfdb/28005 · Nota
• http://securityfocus.com/bid/19417 · Nota