Internet Explorer COM object instantiation vulnerability

2006-02-24T00:00:00
ID SAINT:17E45C40FD52304F9AAD5DBD4801CF11
Type saint
Reporter SAINT Corporation
Modified 2006-02-24T00:00:00

Description

Added: 02/24/2006
CVE: CVE-2005-1990
BID: 14511
OSVDB: 18612

Background

Windows operating systems use the Component Object Model (COM) to allow various program components to be run within different applications.

Problem

Improper instantiation of certain COM objects as ActiveX controls by Internet Explorer leads to a buffer overflow which can result in command execution.

Resolution

Apply the patch referenced in Microsoft Security Bulletin 05-038.

References

<http://www.microsoft.com/technet/security/Bulletin/MS05-038.mspx>

Limitations

This exploit requires a user to follow a link to the exploit from a vulnerable host. Exploit works on Internet Explorer 6.0.

Platforms

Windows 2000
Windows XP
Windows Server 2003