PT-2006-4326 · Microsoft · Hyperlink Object Library+1

Steve Tai · Published 2006-08-08 · Updated 2018-10-12 · CVE-2006-3438

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Hyperlink Object Library (hlink.dll) (affected versions not specified)

Description The issue is related to a remote code execution problem in the Hyperlink Object Library. It occurs when the library handles hyperlinks and encounters a file with a malformed function. An attacker could exploit this by creating a malicious hyperlink. If a user clicks on this link within an Office file or email message, it could lead to remote code execution. The attacker could then take complete control of the affected system. User interaction is required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-3438

Affected Products

Hyperlink Object Library

Windows

References · 10

• http://us-cert.gov/cas/techalerts/TA06-220A.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3438 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3438 · Security Note
• http://kb.cert.org/vuls/id/683612 · Patch
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:115 · Note
• http://securitytracker.com/id?1016659 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A115 · Note
• http://securityfocus.com/bid/19405 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-050 · Note