PT-2005-2224 · Microsoft · Internet Explorer+1

Peter Winter-Smith · Published 2005-06-14 · Updated 2018-10-12 · CVE-2005-1208

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to XP SP3 and Server 2003 SP2

Description The issue is caused by an integer overflow in Microsoft Windows, allowing remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file. This can be triggered by a large size field that causes a heap-based buffer overflow. The vulnerability can be exploited using a "ms-its:" URL in Internet Explorer.

Recommendations For Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier, update to a newer version to mitigate the risk. For versions prior to XP SP3, apply the necessary patches or updates to resolve the issue. For Server 2003 SP2, ensure all security updates are applied to prevent exploitation.

Fix

Related Identifiers

CVE-2005-1208

Affected Products

Internet Explorer

Windows

References · 10

• http://us-cert.gov/cas/techalerts/TA05-165A.html · Patch
• http://kb.cert.org/vuls/id/851869 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-1208 · Security Note
• http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0062.html · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-026 · Vendor Advisory
• http://secunia.com/advisories/15683 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A381 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A463 · Note
• http://securityfocus.com/bid/13953 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1057 · Note