PT-2005-2938 · Microsoft · Internet Explorer

Bernhard Mueller + 1 · Published 2005-08-10 · Updated 2021-07-23 · CVE-2005-1990

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 5.0 through 6.0

Description The issue allows remote attackers to cause a denial of service, potentially leading to the execution of arbitrary code, via a web page with embedded CLSIDs referencing certain COM objects. This results in memory corruption due to the instantiation of these COM objects, including those from various DLL files such as devenum.dll, diactfrm.dll, wmm2filt.dll, fsusd.dll, dmdskmgr.dll, browsewm.dll, browseui.dll, shell32.dll, mshtml.dll, inetcfg.dll, infosoft.dll, query.dll, syncui.dll, clbcatex.dll, clbcatq.dll, comsvcs.dll, and msconf.dll.

Recommendations For Internet Explorer versions 5.0 through 6.0, consider disabling the instantiation of COM objects from the mentioned DLL files as a temporary workaround until a patch is available. Restrict access to web pages that could potentially exploit this issue to minimize the risk of memory corruption and arbitrary code execution.

Exploit

Fix

Related Identifiers

CVE-2005-1990

Affected Products

Internet Explorer

References · 14

• 🔥 https://exploit-db.com/exploits/1144 · Exploit
• http://us-cert.gov/cas/techalerts/TA05-221A.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-1990 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-038 · Vendor Advisory
• http://secunia.com/advisories/16373 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100082 · Note
• http://securitytracker.com/id?1014643 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1337 · Note
• http://kb.cert.org/vuls/id/959049 · Note
• http://securityfocus.com/bid/14511 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1061 · Note
• http://vupen.com/english/advisories/2005/1353 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1235 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1221 · Note