PT-2006-5482 · Microsoft · Wmi Object Broker Activex Control+2

H D Moore + 1 · Publicado 2006-11-01 · Atualizado 2018-10-17 · CVE-2006-4704

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio 2005

Description A cross-zone scripting issue exists in the WMI Object Broker ActiveX control, allowing remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects.

Recommendations For Microsoft Visual Studio 2005, consider disabling the WMI Object Broker ActiveX control until a patch is available. Restrict access to the WmiScriptUtils.dll to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-4704

Produtos afetados

Visual Studio

Wmi Object Broker Activex Control

Wmiscriptutils.Dll

Referências · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_createobject.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16561 · Exploit
• 🔥 http://securityfocus.com/bid/20843 · Exploit
• http://kb.cert.org/vuls/id/854856 · Nota
• http://secunia.com/advisories/22603 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29915 · Nota
• http://research.eeye.com/html/alerts/zeroday/20061031.html · Nota
• http://us-cert.gov/cas/techalerts/TA06-346A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A288 · Nota
• http://zerodayinitiative.com/advisories/ZDI-06-047.html · Nota
• http://vupen.com/english/advisories/2006/4282 · Aviso do Fabricante
• http://securityfocus.com/data/vulnerabilities/exploits/0day_ie.pdf · Nota
• http://microsoft.com/technet/security/advisory/927709.mspx · Aviso do Fabricante
• http://blogs.technet.com/msrc/archive/2006/11/01/microsoft-security-advisory-927709-posted.aspx · Nota
• http://securityfocus.com/bid/20797 · Nota