PT-2006-2318 · Microsoft · Internet Explorer

Published 2006-06-13 · Updated 2021-07-23 · CVE-2006-1303

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1 and earlier

Description The issue allows remote attackers to execute arbitrary code by instantiating certain COM objects as ActiveX controls, including DXImageTransform.Microsoft.MMSpecialEffect1Input, DXImageTransform.Microsoft.MMSpecialEffect1Input.1, DXImageTransform.Microsoft.MMSpecialEffect2Inputs, DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, causing memory corruption during garbage collection. A remote code execution vulnerability exists in the way Internet Explorer instantiates COM objects that are not intended to be instantiated in Internet Explorer. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could potentially allow remote code execution if a user visited the specially crafted Web site.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1 and earlier, consider disabling the instantiation of COM objects as ActiveX controls, specifically those related to DXImageTransform.Microsoft.MMSpecialEffect1Input, DXImageTransform.Microsoft.MMSpecialEffect1Input.1, DXImageTransform.Microsoft.MMSpecialEffect2Inputs, DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-1303

Affected Products

Internet Explorer

References · 28

• http://secunia.com/advisories/20595 · Vendor Advisory
• http://securityfocus.com/bid/18328 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1303 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-1303 · Security Note
• http://vupen.com/english/advisories/2006/2319 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-021 · Vendor Advisory
• http://osvdb.org/26442 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1830 · Note
• http://frsirt.com/english/advisories/2006/2319 · Note
• http://securityfocus.com/archive/1/archive/1/437041/100/0/threaded · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-021 · Note
• http://securitytracker.com/id?1016291 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1135 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26774 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1767 · Note