OSVDB ID: 18612

Title: Microsoft IE Multiple COM Object Embedded CLSID Arbitrary Remote Code Execution

Info

Disclosure
Aug 09, 2005

Discovery
Jul 13, 2005

Dates

Exploit
Aug 11, 2005

Solution
Aug 09, 2005

Description

 Windows contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when Internet Explorer does not properly call interface arguments when instantiating COM components in devenum.dll. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

Windows

 2000 SP4
XP SP1
XP SP2
XP Professional x64 Edition
98
98 SE
ME

Windows Server

 2003
2003 SP1
2003 for Itanium
2003 for Itanium SP1
2003 x64 Edition

References

Credit
  • Hu Qianwei -   -


Direct URL: http://osvdb.org/18612