PT-2006-3344 · Microsoft · Dximagetransform.Microsoft.Light Activex Control+1

Dan Plakosh + 1 · Published 2006-06-13 · Updated 2021-07-23 · CVE-2006-2383

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1 and earlier

Description The issue allows remote attackers to execute arbitrary code via unexpected data related to parameter validation in the DXImageTransform.Microsoft.Light ActiveX control. This can cause Internet Explorer to crash in a way that enables code execution. An attacker could exploit the vulnerability by constructing a specially crafted Web page, potentially allowing remote code execution if a user visits the specially crafted Web site. A successful exploitation could allow an attacker to take complete control of an affected system.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1 and earlier, consider disabling the DXImageTransform.Microsoft.Light ActiveX control as a temporary workaround until a patch is available. Restrict access to Web pages that could potentially exploit this vulnerability to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-2383

Affected Products

Dximagetransform.Microsoft.Light Activex Control

Internet Explorer

References · 27

• 🔥 https://exploit-db.com/exploits/27984 · Exploit
• http://secunia.com/advisories/20595 · Vendor Advisory
• http://securitytracker.com/id?1016291 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2383 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-021 · Vendor Advisory
• http://securityfocus.com/bid/18303 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2383 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26768 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2009 · Note
• http://frsirt.com/english/advisories/2006/2319 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1944 · Note
• http://xforce.iss.net/xforce/xfdb/26768 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-021 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1924 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1891 · Note