PT-2006-4175 · Microsoft · Windows Explorer+2

Plebo Aesdi Nael · Published 2006-06-28 · Updated 2021-07-23 · CVE-2006-3281

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6.0 Windows Explorer (affected versions not specified)

Description The issue arises from the improper handling of Drag and Drop events, allowing remote user-assisted attackers to execute arbitrary code. This can be achieved via a link to an SMB file share with a filename containing encoded .. (%2e%2e%5c) sequences and an extension that includes the CLSID Key identifier for HTML Applications (HTA). An attacker could exploit this by constructing a malicious Web page, potentially allowing them to save a file on the user's system if the user visits a malicious Web site or views a malicious e-mail message. Successful exploitation could grant the attacker complete control of the affected system, requiring user interaction.

Recommendations For Microsoft Internet Explorer version 6.0, update to a newer version to mitigate the risk. For Windows Explorer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-3281

Affected Products

Internet Explorer

Windows

Windows Explorer

References · 19

• 🔥 https://exploit-db.com/exploits/28357 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060627/3d930eda/PLEBO-2006.06.16-IE_ONE_MINOR_ONE_MAJOR.obj · Exploit
• http://vupen.com/english/advisories/2006/2553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3281 · Security Note
• http://secunia.com/advisories/20825 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3281 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-045 · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-045 · Note
• http://securityfocus.com/bid/19389 · Note
• http://securityfocus.com/bid/18682 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047398.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A318 · Note
• http://xforce.iss.net/xforce/xfdb/27456 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27456 · Note
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Note