Signature Detail

HTTP: Dangerous ClassID in ActiveX Object Type 119

This signature detects attempts to exploit a known vulnerability against Internet Explorer. Malicious Web sites, containing dangerous ActiveX CLSID references, can exploit this vulnerability and gain control of client browsers.

Extended Description

Microsoft Internet Explorer is prone to a memory-corruption vulnerability that is related to the instantiation of COM objects. This issue results from a design error. The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in arbitrary code execution. The affected objects are not intended to be instantiated through Internet Explorer. This BID is related to the issues described in BID 14511 (Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability), BID 15061 (Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability), and BID 17453 (Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability). However, this issue affects a different set of COM objects that were not addressed in the previous BIDs.

Affected Products

• Microsoft Internet Explorer 5.0.1
• Microsoft Internet Explorer 5.0.1 For Windows 2000
• Microsoft Internet Explorer 5.0.1 For Windows 95
• Microsoft Internet Explorer 5.0.1 For Windows 98
• Microsoft Internet Explorer 5.0.1 For Windows NT 4.0
• Microsoft Internet Explorer 5.0.1 SP1
• Microsoft Internet Explorer 5.0.1 SP2
• Microsoft Internet Explorer 5.0.1 SP3
• Microsoft Internet Explorer 5.0.1 SP4
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 6.0 SP1

References

• BugTraq: 18328
• CVE: CVE-2006-1303
• URL: http://www.microsoft.com/technet/security/bulletin/MS06-021.mspx