PT-2006-4524 · Microsoft · Internet Explorer

Published 2006-07-17 · Updated 2021-07-23 · CVE-2006-3657

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6

Description The issue allows remote attackers to cause a denial of service, resulting in a stack overflow exception. This can be achieved by utilizing a DXImageTransform.Microsoft.Gradient ActiveX object with a long StartColorStr or EndColorStr property.

Recommendations For Microsoft Internet Explorer version 6, consider avoiding the use of long strings for the StartColorStr and EndColorStr properties in the DXImageTransform.Microsoft.Gradient ActiveX object until a fix is available. As a temporary workaround, restrict the use of this ActiveX object to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3657

Affected Products

Internet Explorer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-3657 · Security Note
• http://vupen.com/english/advisories/2006/2832 · Note
• http://browserfun.blogspot.com/2006/07/mobb-17-dximagetransformmicrosoftgradi.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27762 · Note
• http://securityfocus.com/bid/19029 · Note
• http://osvdb.org/27109 · Note