PT-2006-4595 · Microsoft · Windows Xp Sp2+4

Hdm · Published 2006-07-19 · Updated 2021-07-23 · CVE-2006-3730

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 6 on Windows XP SP2

Description The issue is caused by an integer overflow when a 0x7fffffff argument is passed to the setSlice method on a WebViewFolderIcon ActiveX object, leading to an invalid memory copy. This could allow remote attackers to cause a denial of service or execute arbitrary code. A remote code execution vulnerability exists in Windows Shell due to improper validation of input parameters when invoked by the WebViewFolderIcon ActiveX control. An attacker could exploit this by hosting a specially crafted web site or sending a specially crafted e-mail message, potentially taking complete control of an affected system.

Recommendations For Microsoft Internet Explorer 6 on Windows XP SP2, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the WebViewFolderIcon ActiveX control until a patch is available. Restrict access to web sites that could potentially exploit this vulnerability to minimize the risk of exploitation.

Exploit

Fix

RCE

DoS

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-3730

Affected Products

Internet Explorer 6

Webviewfoldericon Activex

Windows

Windows Shell

Windows Xp Sp2

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_057_webview_setslice.rb · Exploit
• 🔥 https://exploit-db.com/exploits/2448 · Exploit
• 🔥 https://exploit-db.com/exploits/16564 · Exploit
• 🔥 https://exploit-db.com/exploits/2458 · Exploit
• 🔥 https://exploit-db.com/exploits/2460 · Exploit
• 🔥 https://exploit-db.com/exploits/2440 · Exploit
• 🔥 http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.html · Exploit
• 🔥 http://securityfocus.com/bid/19030 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-057 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2882 · Vendor Advisory
• http://secunia.com/advisories/22159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3730 · Security Note
• http://securityfocus.com/archive/1/449179/100/0/threaded · Vendor Advisory
• http://osvdb.org/27110 · Note
• http://securityfocus.com/archive/1/447174/100/0/threaded · Note