PT-2006-4335 · Microsoft · Internet Explorer

Sam Thomas · Published 2006-08-08 · Updated 2021-07-23 · CVE-2006-3450

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6

Description A remote code execution issue exists due to the way Internet Explorer interprets HTML with certain layout positioning combinations. An attacker could exploit this by constructing a specially crafted Web page, potentially allowing remote code execution if a user views the page. Successful exploitation could give an attacker complete control of the affected system. The issue involves the use of the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements.

Recommendations For Microsoft Internet Explorer version 6, consider avoiding the use of the document.getElementByID Javascript function to access crafted CSS elements until a fix is available. Restrict access to specially crafted Web pages to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-3450

Affected Products

Internet Explorer

References · 17

• http://kb.cert.org/vuls/id/119180 · Patch
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Patch
• http://securityfocus.com/bid/19312 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042 · Vendor Advisory
• http://secunia.com/advisories/21396 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3450 · Security Note
• http://vupen.com/english/advisories/2006/3212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3450 · Security Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:433 · Note
• http://securitytracker.com/id?1016663 · Note
• http://frsirt.com/english/advisories/2006/3212 · Note
• http://zerodayinitiative.com/advisories/ZDI-06-027.html · Note
• http://securityfocus.com/archive/1/archive/1/442579/100/0/threaded · Note
• http://securityfocus.com/archive/1/442579/100/0/threaded · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-042 · Note