ID

VAR-200604-0209

CVE

CVE-2006-1185

TITLE

RDS.Dataspace ActiveX control bypasses ActiveX security model

DESCRIPTION

Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption. This can cause a variety of impacts, such as causing IE to crash. Microsoft Internet Explorer (IE) fails to properly handle HTA files. This vulnerability occurs when the browser parses invalid HTML. Attackers can exploit this vulnerability through a malicious web page or HTML email. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-101A Microsoft Windows and Internet Explorer Vulnerabilities Original release date: April 11, 2006 Last revised: -- Source: US-CERT Systems Affected * Microsoft Windows * Microsoft Internet Explorer For more complete information, refer to the Microsoft Security Bulletin Summary for April 2006. I. Description Microsoft Security Bulletin Summary for April 2006 addresses vulnerabilities in Microsoft Windows and Internet Explorer. (CVE-2006-0012) II. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system. An attacker may also be able to cause a denial of service. III. Solution Apply Updates Microsoft has provided updates for these vulnerabilities in the Security Bulletins and on the Microsoft Update site. Workarounds Please see the US-CERT Vulnerability Notes for workarounds. Many of these vulnerabilities can be mitigated by following the instructions listed in the Securing Your Web Browser document. Appendix A. References * Microsoft Security Bulletin Summary for April 2006 - <http://www.microsoft.com/technet/security/bulletin/ms06-apr.mspx> * US-CERT Vulnerability Note VU#876678 - <http://www.kb.cert.org/vuls/id/876678> * US-CERT Vulnerability Note VU#984473 - <http://www.kb.cert.org/vuls/id/984473> * US-CERT Vulnerability Note VU#434641 - <http://www.kb.cert.org/vuls/id/434641> * US-CERT Vulnerability Note VU#503124 - <http://www.kb.cert.org/vuls/id/503124> * US-CERT Vulnerability Note VU#959049 - <http://www.kb.cert.org/vuls/id/959049> * US-CERT Vulnerability Note VU#824324 - <http://www.kb.cert.org/vuls/id/824324> * US-CERT Vulnerability Note VU#341028 - <http://www.kb.cert.org/vuls/id/341028> * US-CERT Vulnerability Note VU#234812 - <http://www.kb.cert.org/vuls/id/234812> * US-CERT Vulnerability Note VU#641460 - <http://www.kb.cert.org/vuls/id/641460> * CVE-2006-1359 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1359> * CVE-2006-1245 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1245> * CVE-2006-1388 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1388> * CVE-2006-1185 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1185> * CVE-2006-1186 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1186> * CVE-2006-1188 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1188> * CVE-2006-1189 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1189> * CVE-2006-0003 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0003> * CVE-2006-0012 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0012> * Microsoft Update - <https://update.microsoft.com/microsoftupdate> * Securing Your Web Browser - <http://www.us-cert.gov/reading_room/securing_browser/#Internet_Ex plorer> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-101A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-101A Feedback VU#876678" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History Apr 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRDwj9n0pj593lg50AQInJggAoOBNa20SU8JukBoK5elr5vWOLcAjycHt Cg0+064ncCpQXoWiYPrLGVzg4/MCTVUygbYl85cePp5cHSHqpfuYXoBuZwSKu36+ olQdkbU1ejViA8A0XPsQ3EgtIRlDZSgL1ncYlRM8QxK8CF7QV616ta8q6H/3EDMM i+tXy6gzQMqJeUthopzGcfpf6U5Qu9PCk/+Pj66GfFhHpARanLef2H28WFRazC+I R+vLGLFLV0gp1Iy7t267l1BhN1w1z+fXD0WwYkiTwb0mzeize8Amdqlb5c4Vn4wh HAF/XGiCe5qkMhM7kRLA70JsNfSkI38JPHWSo9/a04wFBKENCAwNpA== =w6IC -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Microsoft Design Tools msdds.dll Code Execution Vulnerability SECUNIA ADVISORY ID: SA16480 VERIFY ADVISORY: http://secunia.com/advisories/16480/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote SOFTWARE: Microsoft Visual Studio .NET 2003 http://secunia.com/product/1086/ Microsoft Office 2003 Student and Teacher Edition http://secunia.com/product/2278/ Microsoft Office 2003 Standard Edition http://secunia.com/product/2275/ Microsoft Internet Explorer 5.01 http://secunia.com/product/9/ Microsoft Internet Explorer 5.5 http://secunia.com/product/10/ Microsoft Internet Explorer 6.x http://secunia.com/product/11/ Microsoft Office 2003 Professional Edition http://secunia.com/product/2276/ Microsoft Office 2003 Small Business Edition http://secunia.com/product/2277/ DESCRIPTION: A vulnerability has been reported in Microsoft Visual Studio .NET, which potentially can be exploited by malicious people to compromise a vulnerable system. The COM object is known to be installed as part of the following products: * Microsoft Visual Studio .NET 2003 * Microsoft Office Professional 2003 Other products may also include the affected COM object. NOTE: An exploit has been published. However, there are currently conflicting reports about the exploitability of this issue. Some reports confirm that code execution is possible, while other reports indicate that the problem can't be reproduced. Secunia has currently not been able to reproduce the vulnerability in version 7.10.3077.0 of the COM object. This advisory will be updated when more information is available. SOLUTION: Restrict use of ActiveX controls to trusted web sites only. PROVIDED AND/OR DISCOVERED BY: Reported by anonymous person. ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Jan P. Monsch jan.monsch@csnc.ch

SOURCES

LAST UPDATE DATE

2024-12-10T20:58:00.511000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE