PT-2006-2261 · Microsoft · Internet Explorer

Michal Zalewski · Published 2006-03-16 · Updated 2018-10-18 · CVE-2006-1245

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6.0.2900.2180 Microsoft Internet Explorer (affected versions not specified)

Description A remote code execution issue exists in the way Internet Explorer handles multiple event handlers in an HTML element. This could allow an attacker to execute arbitrary code via an HTML tag with a large number of script action handlers, such as onload and onmouseover. An attacker could exploit this by constructing a malicious Web page, potentially allowing remote code execution if a user visits the site. A successful exploitation could give the attacker complete control of the affected system.

Recommendations For Microsoft Internet Explorer version 6.0.2900.2180, consider disabling the handling of multiple event handlers in HTML elements as a temporary workaround until a patch is available. For other affected versions of Microsoft Internet Explorer, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-1245

Affected Products

Internet Explorer

References · 34

• 🔥 http://osvdb.org/23964 · Exploit
• 🔥 https://exploit-db.com/exploits/27433 · Exploit
• 🔥 https://exploit-db.com/exploits/1838 · Exploit
• 🔥 http://securityfocus.com/bid/17131 · Exploit
• http://secunia.com/advisories/19269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1245 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-013 · Vendor Advisory
• http://securitytracker.com/id?1015794 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1245 · Security Note
• http://secunia.com/advisories/18957 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1766 · Note
• http://securityfocus.com/archive/1/archive/1/453554/100/0/threaded · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1766 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1569 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1632 · Note