PT-2006-4513 · Microsoft · Windows Management Console+4

H D Moore + 2 · Published 2006-08-08 · Updated 2021-07-23 · CVE-2006-3643

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 5.01 through 6 Microsoft Windows 2000 SP4

Description The issue allows remote authenticated users to execute arbitrary commands due to a cross-site scripting (XSS) vulnerability. This vulnerability could permit access to local HTML-embedded resource files in the Microsoft Management Console (MMC) library. A remote code execution vulnerability in the Windows Management Console could allow an attacker to take complete control of the affected system.

Recommendations For Internet Explorer versions 5.01 through 6, update to a version that is not affected by this issue. For Microsoft Windows 2000 SP4, consider restricting access to the Microsoft Management Console (MMC) library until a patch is available. As a temporary workaround, consider disabling the execution of arbitrary commands in the MMC library to minimize the risk of exploitation.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-3643

Affected Products

Internet Explorer

Management Console

Windows

Windows 2000

Windows Management Console

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2006-3643 · Security Note
• http://us-cert.gov/cas/techalerts/TA06-220A.html · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-044 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3643 · Security Note
• http://kb.cert.org/vuls/id/927548 · Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A638 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28005 · Note
• http://securitytracker.com/id?1016655 · Note
• http://secunia.com/advisories/21401 · Note
• http://frsirt.com/english/advisories/2006/3213 · Note
• http://vupen.com/english/advisories/2006/3213 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:638 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-044 · Note
• http://xforce.iss.net/xforce/xfdb/28005 · Note
• http://securityfocus.com/bid/19417 · Note