CVE-2005-2127 Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that refer...
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ati catalyst driver | All versions | No fix listed |
| Microsoft net framework | = 1.1 | No fix listed |
| Microsoft net framework | = 1.1-sp1 | No fix listed |
| Microsoft net framework | = 1.1-sp2 | No fix listed |
| Microsoft net framework | = 1.1-sp3 | No fix listed |
| Microsoft office | All versions | No fix listed |
| Microsoft office | = 2000 | No fix listed |
| Microsoft office | = 2000-sp1 | No fix listed |
| Microsoft office | = 2000-sp2 | No fix listed |
| Microsoft office | = 2000-sp3 | No fix listed |
| Microsoft office | = xp-sp1 | No fix listed |
| Microsoft office | = xp-sp2 | No fix listed |
| Microsoft office | = xp-sp3 | No fix listed |
| Microsoft project | = 98 | No fix listed |
| Microsoft project | = 2000 | No fix listed |
| Microsoft project | = 2002 | No fix listed |
| Microsoft project | = 2002-sp1 | No fix listed |
| Microsoft project | = 2003 | No fix listed |
| Microsoft project | = 2003-sp1 | No fix listed |
| Microsoft visio | = 2000-sr1 | No fix listed |
| Microsoft visio | = 2002 | No fix listed |
| Microsoft visio | = 2002-sp1 | No fix listed |
| Microsoft visio | = 2002-sp2 | No fix listed |
| Microsoft visio | = 2003 | No fix listed |
| Microsoft visio | = 2003-sp1 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft visual studio .net | = 2002-gold | No fix listed |
| Microsoft visual studio .net | = 2003 | No fix listed |
| Microsoft visual studio .net | = 2003-gold | No fix listed |
| Microsoft visual studio .net | = gold | No fix listed |
References
- isc.sans.org third-party-advisory
- 16480 patch third-party-advisory vendor-advisory
- 17172 permissions-required third-party-advisory
- 17223 permissions-required third-party-advisory
- 17509 permissions-required third-party-advisory
- 72 third-party-advisory
- 1014727 exploit patch third-party-advisory vdb-entry vendor-advisory
- support.avaya.com third-party-advisory
- VU#740372 third-party-advisory us-government-resource
- VU#898241 third-party-advisory us-government-resource
- VU#959049 third-party-advisory us-government-resource
- www.microsoft.com mitigation patch vendor-advisory
- 20070606 IE 6/Microsoft Html Popup Window (mshtml.dll) DoS mailing-list
- 14594 exploit patch third-party-advisory vdb-entry
- 15061 third-party-advisory vdb-entry
- TA05-284A third-party-advisory us-government-resource
- TA05-347A third-party-advisory us-government-resource
- TA06-220A third-party-advisory us-government-resource
- ADV-2005-1450 broken-link vdb-entry
- MS05-052 vendor-advisory
- Win-msdss-command-execution(21895) vdb-entry
- microsoft-ie-mshtml-dos(34754) vdb-entry
- oval:org.mitre.oval:def:1155 signature vdb-entry
- oval:org.mitre.oval:def:1454 signature vdb-entry
- oval:org.mitre.oval:def:1464 signature vdb-entry
- oval:org.mitre.oval:def:1468 signature vdb-entry
- oval:org.mitre.oval:def:1535 signature vdb-entry
- oval:org.mitre.oval:def:1538 signature vdb-entry