Signature Detail
Short Name |
HTTP:STC:ACTIVEX:COM-OBJ |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Microsoft COM Object Instantiation Memory Corruption |
Release Date |
2007/02/13 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Microsoft COM Object Instantiation Memory Corruption
This signature detects attempts to exploit a known vulnerability in Microsoft Internet Explorer. An attacker could exploit the vulnerability by constructing a specially crafted Web page that can potentially allow remote code execution if a user viewed the Web page. An attacker who successfully exploited this vulnerability can take complete control of an affected system.
Extended Description
Microsoft Internet Explorer is prone to a memory-corruption vulnerability when instantiating certain COM objects. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application. This facilitates the remote compromise of affected computers. Internet Explorer 7 on Microsoft Vista is not affected by this issue; Internet Explorer 7 on other Windows versions is affected only if COM objects have been enabled by the ActiveX opt-in feature. This BID is similar to the one described in BID 15827 (Microsoft Internet Explorer COM Object Instantiation Memory Corruption Vulnerability), but it affects a different set of COM objects.
Affected Products
- Avaya Agent Access
- Avaya Basic Call Management System Reporting Desktop server
- Avaya Basic Call Management System Reporting Desktop
- Avaya CMS Supervisor
- Avaya Computer Telephony
- Avaya Contact Center Express
- Avaya CVLAN
- Avaya Enterprise Management
- Avaya Integrated Management
- Avaya Interaction Center
- Avaya Interaction Center - Voice Quick Start
- Avaya IP Agent
- Avaya IP Softphone
- Avaya Messaging Application Server
- Avaya Modular Messaging (MAS)
- Avaya Network Reporting
- Avaya OctelAccess(r) Server
- Avaya OctelDesignerTM
- Avaya Operational Analyst
- Avaya Outbound Contact Management
- Avaya S8100 Media Servers R10
- Avaya S8100 Media Servers R11
- Avaya S8100 Media Servers R12
- Avaya S8100 Media Servers R6
- Avaya S8100 Media Servers R7
- Avaya S8100 Media Servers R8
- Avaya S8100 Media Servers R9
- Avaya S8100 Media Servers
- Avaya Speech Access
- Avaya Unified Communication Center
- Avaya Unified Messenger (r)
- Avaya Visual Messenger TM
- Avaya Visual Vector Client
- Avaya VPNmanagerTM Console
- Avaya Web Messenger
- HP Storage Management Appliance 2.1
- Microsoft Internet Explorer 5.0.1
- Microsoft Internet Explorer 5.0.1 SP1
- Microsoft Internet Explorer 5.0.1 SP2
- Microsoft Internet Explorer 5.0.1 SP3
- Microsoft Internet Explorer 5.0.1 SP4
- Microsoft Internet Explorer 6.0
- Microsoft Internet Explorer 6.0 SP1
- Microsoft Internet Explorer 7.0
- Nortel Networks CallPilot 1002Rp
- Nortel Networks CallPilot 200I
- Nortel Networks CallPilot 201I
- Nortel Networks CallPilot 702T
- Nortel Networks CallPilot 703T
- Nortel Networks Centrex IP Client Manager 7.0.0
- Nortel Networks Centrex IP Client Manager 8.0.0
- Nortel Networks Centrex IP Client Manager 9.0
- Nortel Networks Contact Center
- Nortel Networks Contact Center Express
- Nortel Networks Contact Center Manager
- Nortel Networks Contact Center Manager Server
- Nortel Networks Symposium Network Control Center (NCC)
References
- BugTraq: 22486
- CVE: CVE-2006-4697
- URL: http://www.microsoft.com/technet/security/Bulletin/MS07-016.mspx