PT-2006-5110 · Microsoft · Directx+1

Dr.Pantagon · Publicado 2006-08-23 · Atualizado 2018-10-17 · CVE-2006-4301

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6.0 SP1

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by utilizing a long Color attribute in multiple DirectX Media Image DirectX Transforms ActiveX COM Objects. These objects include DXImageTransform.Microsoft.MaskFilter.1, DXImageTransform.Microsoft.Chroma.1, and DX3DTransform.Microsoft.Shapes.1 from the dxtmsft.dll and dxtmsft3.dll libraries.

Recommendations For Microsoft Internet Explorer version 6.0 SP1, consider disabling the use of DirectX Media Image DirectX Transforms ActiveX COM Objects, specifically DXImageTransform.Microsoft.MaskFilter.1, DXImageTransform.Microsoft.Chroma.1, and DX3DTransform.Microsoft.Shapes.1, until a patch is available. Restrict access to the dxtmsft.dll and dxtmsft3.dll libraries to minimize the risk of exploitation. Avoid using long Color attributes in these ActiveX objects to prevent potential crashes.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-4301

Produtos afetados

Directx

Internet Explorer

Referências · 10

• 🔥 https://exploit-db.com/exploits/28421 · Exploit
• 🔥 https://exploit-db.com/exploits/4251 · Exploit
• 🔥 http://xsec.org/index.php?module=releases&act=view&type=1&id=17 · Exploit
• 🔥 http://securityfocus.com/bid/19640 · Exploit
• http://osvdb.org/29525 · Nota
• http://osvdb.org/29524 · Nota
• http://securityreason.com/securityalert/1439 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4301 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28516 · Nota
• http://securityfocus.com/archive/1/443907/100/0/threaded · Nota