PT-2006-5552 · Microsoft · Directanimation Path Control+1

Nop · Published 2006-09-13 · Updated 2018-10-17 · CVE-2006-4777

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Internet Explorer 6.0 SP1

Description The issue allows remote attackers to execute arbitrary code via manipulations in arguments to the KeyFrame method of the DirectAnimation Path Control COM object. This could be related to an integer overflow. The vulnerability can be exploited if the ActiveX controls are passed unexpected data, potentially allowing remote code execution if a user visits a specially crafted Web page. An attacker who successfully exploits this issue could take complete control of an affected system.

Recommendations For Internet Explorer 6.0 SP1, consider disabling the DirectAnimation ActiveX controls until a patch is available. Restrict access to the daxctle.ocx COM object to minimize the risk of exploitation. Avoid using the KeyFrame method in the affected ActiveX controls until the issue is resolved.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-4777

Affected Products

Directanimation Path Control

Internet Explorer

References · 32

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_067_keyframe.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16506 · Exploit
• 🔥 https://exploit-db.com/exploits/2358 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4777 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-4777 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-067 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3593 · Vendor Advisory
• http://secunia.com/advisories/21910 · Vendor Advisory
• http://osvdb.org/28842 · Note
• http://frsirt.com/english/advisories/2006/3593 · Note
• http://securityreason.com/securityalert/1577 · Note
• http://securityfocus.com/archive/1/archive/1/446246/100/0/threaded · Note
• http://securityfocus.com/archive/1/archive/1/446084/100/0/threaded · Note
• http://securityfocus.com/archive/1/archive/1/446065/100/0/threaded · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-067 · Note