PT-2006-6433 · Microsoft · Internet Explorer+2

Dror Shalev + 2 · Published 2006-11-06 · Updated 2021-04-09 · CVE-2006-5745

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft XML Core Services 4.0

Description: The issue is related to an unspecified vulnerability in the setRequestHeader method in the XMLHTTP ActiveX Control 4.0. This vulnerability can be exploited by remote attackers to execute arbitrary code via crafted arguments, leading to memory corruption. The vulnerability is specific to when the control is accessed by Internet Explorer.

Recommendations: For Microsoft XML Core Services 4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-5745

Affected Products

Internet Explorer

Xml Core Services

Xmlhttp Activex Control

References · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms06_071_xml_core.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16532 · Exploit
• 🔥 https://exploit-db.com/exploits/2753 · Exploit
• 🔥 https://exploit-db.com/exploits/2743 · Exploit
• 🔥 https://exploit-db.com/exploits/2749 · Exploit
• 🔥 http://securityfocus.com/bid/20915 · Exploit
• http://xforce.iss.net/xforce/alerts/id/239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5745 · Security Note
• http://secunia.com/advisories/22687 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-071 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA06-318A.html · Note
• https://t.me/cvenotify/12999 · Telegram Post
• http://blogs.securiteam.com/?p=717 · Note
• http://microsoft.com/technet/security/advisory/927892.mspx · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30004 · Note