Microsoft Internet Explorer Bug in Instantiating COM Objects May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015348
|
|
SecurityTracker URL: http://securitytracker.com/id?1015348
|
|
CVE Reference: CVE-2005-2831
(Links to External Site)
|
Date: Dec 13 2005
|
Impact: Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 5.01 SP4, 5.5 SP2, 6 SP1; and prior service packs
|
Description: A vulnerability was reported in Microsoft Internet Explorer. A remote user can cause arbitrary code to be executed on the target system.
When Internet Explorer instantiates certain COM objects as ActiveX Controls, the affected COM objects may corrupt the system state
and allow arbitrary code to be executed.
A remote user can create specially crafted HTML that, when loaded by the target user,
will cause arbitrary code to be executed on the target system. The code may run with System privileges.
Microsoft credits Will
Dormann of CERT/CC with reporting some of the affected class identifiers.
|
Impact: A remote user can create HTML that, when loaded by the target user, will cause arbitrary code to be executed on the target user's system.
|
Solution: The vendor has issued the following fixes:
Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details
.aspx?FamilyId=4005B74A-D6E6-4A32-A3B1-276686B4A428
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack
4 or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A8443CD2-D98D-427B-9F0E-BD7E19FCB994
Internet
Explorer 6 for Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E4B5BA57-D4F2-4798-9154-2869E371C9D1
Internet
Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9D70FB20-C7C9-4
3AF-A864-6DBC9A542CC6
Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server
2003 with SP1 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1EE790B9-E596-4344-AEC3-FCB3289D7E9C
Internet
Explorer 6 for Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8E9C23E5-7988-42DA-A8BD-2C1A534BF995
Internet
Explorer 6 for Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E1652B4A-6339-4B31-8ACF-D2A844C24F70
A
restart is required.
This cumulative update supercedes the update provided in MS05-052.
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-054.mspx (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (98), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 13 Dec 2005 13:41:01 -0500
Subject: MS05-054
|
http://www.microsoft.com/technet/security/Bulletin/MS05-054.mspx
|
|
