PT-2006-4249 · Microsoft · Internet Explorer+2

Cody Pierce · Published 2006-07-06 · Updated 2021-07-23 · CVE-2006-3357

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 6.0

Description A heap-based buffer overflow issue exists in the HTML Help ActiveX control, allowing remote attackers to cause a denial of service or possibly execute arbitrary code. This can be achieved by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values. The issue may be related to improper escaping and long strings. An attacker could exploit this by constructing a malicious web page, potentially allowing remote code execution if a user visits the page, and could take complete control of the affected system.

Recommendations For Microsoft Internet Explorer 6.0, consider disabling the HTML Help ActiveX control until a patch is available to prevent potential exploitation. Restrict access to malicious web pages to minimize the risk of remote code execution.

Exploit

Fix

Related Identifiers

CVE-2006-3357

Affected Products

Html Help Activex Control

Internet Explorer

Windows

References · 22

• 🔥 http://securityfocus.com/bid/18769 · Exploit
• http://secunia.com/advisories/20906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3357 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-046 · Vendor Advisory
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-046 · Note
• http://securityfocus.com/archive/1/442733/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27573 · Note
• http://tippingpoint.com/security/advisories/TSRT-06-08.html · Note
• http://browserfun.blogspot.com/2006/07/mobb-2-internethhctrl-image-property.html · Note
• http://frsirt.com/english/advisories/2006/2634 · Note
• http://osvdb.org/26835 · Note
• http://securitytracker.com/id?1016434 · Note
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Note