PT-2004-1991 · Microsoft · Internet Explorer+1

John Heasman · Published 2004-10-21 · Updated 2020-12-09 · CVE-2004-0978

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 6

Description: A heap-based buffer overflow issue exists in the Hrtbeat.ocx (Heartbeat) ActiveX control. This issue can be exploited by remote attackers to execute arbitrary code when users visit specific online gaming sites associated with MSN. The exploitation is possible via the SetupData parameter.

Recommendations: For Internet Explorer versions 5.01 through 6, consider disabling the Hrtbeat.ocx (Heartbeat) ActiveX control as a temporary workaround until a patch is available. Restrict access to online gaming sites associated with MSN to minimize the risk of exploitation. Avoid using the SetupData parameter in the affected ActiveX control until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2004-0978

Affected Products

Hrtbeat.Ocx (Heartbeat) Activex Control

Internet Explorer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0978 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17714 · Note
• http://marc.info/?l=bugtraq&m=110616221411579&w=2 · Note
• http://kb.cert.org/vuls/id/673134 · Note
• http://securityfocus.com/bid/11367 · Note
• http://ngssoftware.com/advisories/heartbeatfull.txt · Note