PT-2006-3074 · Microsoft · Activex+3

Jesse Ruderman · Published 2006-04-29 · Updated 2021-07-23 · CVE-2006-2094

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions prior to Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1

Description The issue allows remote attackers to construct a race condition, tricking a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing an ActiveX control. This occurs when the Prompt is configured in Security Settings, and modal dialogs are used to verify user intentions.

Recommendations For Microsoft Internet Explorer versions prior to Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, update to Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 to resolve the issue.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2006-2094

Affected Products

Activex

Internet Explorer

Windows Server 2003

Windows Xp

References · 13

• 🔥 https://exploit-db.com/exploits/27744 · Exploit
• 🔥 http://securityfocus.com/bid/17713 · Exploit
• http://student.missouristate.edu/m/matthew007/advisories.asp?adv=2006-02 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2094 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045589.html · Note
• http://securitytracker.com/id?1015720 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0759.html · Note
• http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0019.html · Note
• http://osvdb.org/22351 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26111 · Note
• http://squarefree.com/2004/07/01/race-conditions-in-security-dialogs · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0264.html · Note