PT-2006-1646 · Adobe+1 · Shockwave Flash+1

Published 2006-02-08 · Updated 2021-07-23 · CVE-2006-0585

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6.0 SP1 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash. This is achieved through a Shockwave Flash object containing ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, triggering a null dereference.

Recommendations For Microsoft Internet Explorer versions 6.0 SP1 and earlier, consider upgrading to a newer version to resolve the issue. As a temporary workaround, restrict the use of Shockwave Flash objects that contain ActionScript code to minimize the risk of exploitation. Avoid using the document.write function in Javascript until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-0585

Affected Products

Internet Explorer

Shockwave Flash

References · 5

• 🔥 http://securityfocus.com/bid/16441 · Exploit
• 🔥 http://securitytracker.com/id?1015559 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0585 · Security Note
• http://securityfocus.com/archive/1/425422/30/6890/threaded · Note
• http://securityfocus.com/archive/1/423675/100/0/threaded · Note