PT-2006-5110 · Microsoft · Directx+1

Dr.Pantagon · Published 2006-08-23 · Updated 2018-10-17 · CVE-2006-4301

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6.0 SP1

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by utilizing a long Color attribute in multiple DirectX Media Image DirectX Transforms ActiveX COM Objects. These objects include DXImageTransform.Microsoft.MaskFilter.1, DXImageTransform.Microsoft.Chroma.1, and DX3DTransform.Microsoft.Shapes.1 from the dxtmsft.dll and dxtmsft3.dll libraries.

Recommendations For Microsoft Internet Explorer version 6.0 SP1, consider disabling the use of DirectX Media Image DirectX Transforms ActiveX COM Objects, specifically DXImageTransform.Microsoft.MaskFilter.1, DXImageTransform.Microsoft.Chroma.1, and DX3DTransform.Microsoft.Shapes.1, until a patch is available. Restrict access to the dxtmsft.dll and dxtmsft3.dll libraries to minimize the risk of exploitation. Avoid using long Color attributes in these ActiveX objects to prevent potential crashes.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-4301

Affected Products

Directx

Internet Explorer

References · 10

• 🔥 https://exploit-db.com/exploits/28421 · Exploit
• 🔥 https://exploit-db.com/exploits/4251 · Exploit
• 🔥 http://xsec.org/index.php?module=releases&act=view&type=1&id=17 · Exploit
• 🔥 http://securityfocus.com/bid/19640 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4301 · Security Note
• http://osvdb.org/29525 · Note
• http://osvdb.org/29524 · Note
• http://securityreason.com/securityalert/1439 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28516 · Note
• http://securityfocus.com/archive/1/443907/100/0/threaded · Note