Microsoft IE DXImageTransform.Microsoft.RevealTrans Transition Property NULL Dereference

2006-07-12T00:00:00
ID OSVDB:27057
Type osvdb
Reporter H D Moore(hdm@metasploit.com)
Modified 2006-07-12T00:00:00

Description

Vulnerability Description

Internet Explorer contains a flaw that may allow a local denial of service. The issue is triggered when setting the "Transition" property of an instance of the ActiveX object "DXImageTransform.Microsoft.RevealTrans.1." to 1. This will cause a NULL dereference and a loss of availability for the browser.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

Internet Explorer contains a flaw that may allow a local denial of service. The issue is triggered when setting the "Transition" property of an instance of the ActiveX object "DXImageTransform.Microsoft.RevealTrans.1." to 1. This will cause a NULL dereference and a loss of availability for the browser.

References:

Vendor URL: http://www.microsoft.com Other Advisory URL: http://browserfun.blogspot.com/2006/07/mobb-13-revealtrans-transition.html Keyword: MoBB #13 Generic Exploit URL: http://metasploit.com/users/hdm/tools/browserfun/mobb_013.html FrSIRT Advisory: ADV-2006-2793 CVE-2006-3605 Bugtraq ID: 18960