18612 : Microsoft IE Multiple COM Object Embedded CLSID Arbitrary Remote Code Execution
Printer | http://osvdb.org/18612 | Email This | Edit Vulnerability

Views This Week
4

Views All Time
173

Info

Last Modified
10 months ago

Percent Complete
100%

Disclosure
Aug 09, 2005

Discovery
Jul 13, 2005

Dates

Exploit
Aug 11, 2005

Solution
Unknown

Description

 Windows contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when Internet Explorer does not properly call interface arguments when instantiating COM components in devenum.dll. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products
Microsoft Corporation
Watch-list
Windows
Watch-list
 2000 SP4
XP SP1
XP SP2
XP Professional x64 Edition
98
98 SE
ME
Windows Server
Watch-list
 2003
2003 SP1
2003 for Itanium
2003 for Itanium SP1
2003 x64 Edition

References

Tools & Filters

Nessus

 19401

Snort

 4133 4134 7948 7949 7970 7971 7976 7977 7989 7990 7991 7992 7993 7994 7995 7996 7997 7998 7999 8000 8001 8002 8003 8004 8005 8006 8007 8008 8009 8010 8011 8012 8013 8014 8015 8016 8017 8018 8019 8020 8021 8022 8023 8024 8025 8026 8027 8028 8029 8030 8031 8032 8033 8034 8035 8036 8037 8038 8039 8040 8041 8042 8043 8044 8045 8046 8047 8048 8049 8050 8051 8052

Credit
  • Hu Qianwei - NSFOCUS Security Team

Blogs

Provided by Technorati

 None found at this time

Comments

Add Comment

No Comments.

DONATE NOW!

User Status

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use