PT-2006-4595 · Microsoft · Windows Xp Sp2+4

Hdm · Publicado 2006-07-19 · Atualizado 2021-07-23 · CVE-2006-3730

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 6 on Windows XP SP2

Description The issue is caused by an integer overflow when a 0x7fffffff argument is passed to the setSlice method on a WebViewFolderIcon ActiveX object, leading to an invalid memory copy. This could allow remote attackers to cause a denial of service or execute arbitrary code. A remote code execution vulnerability exists in Windows Shell due to improper validation of input parameters when invoked by the WebViewFolderIcon ActiveX control. An attacker could exploit this by hosting a specially crafted web site or sending a specially crafted e-mail message, potentially taking complete control of an affected system.

Recommendations For Microsoft Internet Explorer 6 on Windows XP SP2, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the WebViewFolderIcon ActiveX control until a patch is available. Restrict access to web sites that could potentially exploit this vulnerability to minimize the risk of exploitation.

Exploit

Correção

RCE

DoS

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-3730

Produtos afetados

Internet Explorer 6

Webviewfoldericon Activex

Windows

Windows Shell

Windows Xp Sp2

Referências · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_057_webview_setslice.rb · Exploit
• 🔥 https://exploit-db.com/exploits/2448 · Exploit
• 🔥 https://exploit-db.com/exploits/16564 · Exploit
• 🔥 https://exploit-db.com/exploits/2458 · Exploit
• 🔥 https://exploit-db.com/exploits/2460 · Exploit
• 🔥 https://exploit-db.com/exploits/2440 · Exploit
• 🔥 http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.html · Exploit
• 🔥 http://securityfocus.com/bid/19030 · Exploit
• http://osvdb.org/27110 · Nota
• http://securityfocus.com/archive/1/447174/100/0/threaded · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-057 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A339 · Nota
• http://securityfocus.com/archive/1/447490/100/0/threaded · Nota
• http://us-cert.gov/cas/techalerts/TA06-270A.html · Nota
• http://riosec.com/msie-setslice-vuln · Nota