CVE-2005-4717 Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash...
MediumCVSS 5.0
EPSS 16.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contains a malformed IMG tag, as demonstrated by IEcrash.htm and IEcrash.rar.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft ie | = 6.0-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = sp1 | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20051101 new IE bug (confirmed on ALL windows) exploit mailing-list
- 20051104 RE: new IE bug (confirmed on ALL windows) mailing-list
- 15268 exploit vdb-entry