PT-2005-3063 · Microsoft · Internet Explorer

Parvez Anwar · Published 2005-08-19 · Updated 2018-10-19 · CVE-2005-2127

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 5.01, 5.5, and 6

Description: The issue allows remote attackers to cause a denial of service, potentially leading to arbitrary code execution, via a web page with embedded CLSIDs referencing certain COM objects not intended for use within Internet Explorer. This is demonstrated using various COM objects, including the DDS Library Shape Control and other specified objects.

Recommendations: For Microsoft Internet Explorer versions 5.01, 5.5, and 6, consider disabling the use of COM objects within Internet Explorer as a temporary workaround until a patch is available. Restrict access to the specified COM objects to minimize the risk of exploitation. Avoid using web pages with embedded CLSIDs that reference these COM objects until the issue is resolved.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2005-2127

Affected Products

Internet Explorer

References · 31

• 🔥 https://exploit-db.com/exploits/26167 · Exploit
• 🔥 http://securitytracker.com/id?1014727 · Exploit
• 🔥 http://securityfocus.com/bid/14594 · Exploit
• http://microsoft.com/technet/security/advisory/906267.mspx · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-052 · Vendor Advisory
• http://secunia.com/advisories/16480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2127 · Security Note
• http://securityfocus.com/bid/15061 · Note
• http://kb.cert.org/vuls/id/898241 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1538 · Note
• http://secunia.com/advisories/17223 · Note
• http://securityreason.com/securityalert/72 · Note
• http://secunia.com/advisories/17172 · Note
• http://us-cert.gov/cas/techalerts/TA05-284A.html · Note
• http://secunia.com/advisories/17509 · Note