var-200102-0077
Vulnerability from variot
Memory leak in Cisco Catalyst 4000, 5000, and 6000 series switches allows remote attackers to cause a denial of service via a series of failed telnet authentication attempts. There is a buffer overflow in the IBM AIX setclock command that may allow local attackers to gain root privileges. Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability
By Sowhat of Nevis Labs Date: 2006.04.11
http://www.nevisnetworks.com http://secway.org/advisory/AD20060411.txt http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx
CVE: CVE-2006-1189
Vendor Microsoft Inc.
Products affected:
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 and Microsoft Windows XP Service Pack 1 Internet Explorer 6 for Microsoft Windows XP Service Pack 2 Internet Explorer 6 for Microsoft Windows Server 2003 Internet Explorer 6 Service Pack 1 on Microsoft Windows 98, Microsoft Windows 98 SE, and Microsoft Windows Millennium Edition
This vulnerability affects systems that use Double-Byte Character Sets. Systems that are affected are Windows language versions that use a Double Byte Character Set language. Examples of languages that use DBCS are Chinese, Japanese, and Korean languages. Customers using other language versions of Windows might also be affected if "Language for non-Unicode programs" has been set to a Double Byte Character Set language.
Overview:
There exists a buffer overflow in Microsoft Internet Explorer in the parsing of DBCS URLS.
This vulnerability could allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.
This attack may be utilized wherever IE parses HTML, such as webpages, email, newsgroups, and within applications utilizing web-browsing functionality.
Details:
URLMON.DLL does not properly validate IDN containing double-byte character sets (DBCS), which may lead to remote code execution.
Exploiting this vulnerability seems to need a lot of more work but we believe that exploitation is possible.
POC:
No PoC will be released for this.
FIX:
Microsoft has released an update for Internet Explorer which is set to address this issue. This can be downloaded from:
http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx
Vendor Response:
2005.12.29 Vendor notified via secure@microsoft.com 2005.12.29 Vendor responded 2006.04.11 Vendor released MS06-0xx patch 2006.04.11 Advisory released
Common Vulnerabilities and Exposures (CVE) Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned the following names to these issues. These are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
CVE-2006-1189
Greetings to Lennart@MS, Chi, OYXin, Narasimha Datta, all Nevis Labs guys, all XFocus and 0x557 guys :)
References:
- http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx
- http://www.nsfocus.com/english/homepage/research/0008.htm
- http://xforce.iss.net/xforce/xfdb/5729
- http://www.securityfocus.com/bid/2100/discuss
- http://www.inter-locale.com/whitepaper/IUC27-a303.html
- http://blogs.msdn.com/michkap/archive/2005/10/28/486034.aspx
- [Mozilla Firefox IDN "Host:" Buffer Overflow] http://www.security-protocols.com/advisory/sp-x17-advisory.txt
- [Mozilla Firefox 1.5 Beta 1 IDN Buffer Overflow] http://www.security-protocols.com/advisory/sp-x18-advisory.txt
- http://72.14.203.104/search?q=cache:Dxn-V4fil1IJ:developer.novell.com /research/devnotes/1995/may/02/05.htm
-- Sowhat http://secway.org "Life is like a bug, Do you know how to exploit it ?"
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200102-0077",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": null,
"scope": null,
"trust": 2.4,
"vendor": "ibm",
"version": null
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.5\\(4\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.3\\(4\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.5\\(2\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.2\\(1\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.5\\(4a\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.3\\(3\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.5\\(9\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.2\\(1a\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.5\\(8\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "5.3\\(5\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.1\\(2a\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3\\(5a\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.5\\(6\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2\\(4\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2\\(3\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2\\(7\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.1\\(1a\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.1\\(1\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2\\(5\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3\\(6\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.5\\(2\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2\\(6\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5\\(1\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4\\(4\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.1"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3\\(2\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.5\\(4\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.5\\(5\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.5\\(7\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3\\(1a\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4\\(2\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4\\(3\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2\\(2\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "4.5\\(3\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.3\\(1\\)csx"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.4\\(1\\)"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.2"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5"
},
{
"model": "catos",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "5.5\\(3\\)"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#739201"
},
{
"db": "CERT/CC",
"id": "VU#808633"
},
{
"db": "CERT/CC",
"id": "VU#886953"
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(4\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(5\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.1\\(2a\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(6\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(7\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(5a\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(6\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.5\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.5\\(3\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(8\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(9\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(3\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(2\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(3\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.4\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.4\\(3\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.4\\(4\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(3\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.1\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.1\\(1a\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(4\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(5\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(4\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(5\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(6\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:4.5\\(7\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.2\\(1a\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(1\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.3\\(1a\\)csx:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.4\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.5\\(4\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:catos:5.5\\(4a\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sowhat",
"sources": [
{
"db": "PACKETSTORM",
"id": "45442"
}
],
"trust": 0.1
},
"cve": "CVE-2001-0041",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-2863",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2001-0041",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#739201",
"trust": 0.8,
"value": "7.09"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#808633",
"trust": 0.8,
"value": "5.36"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#872257",
"trust": 0.8,
"value": "7.09"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#886953",
"trust": 0.8,
"value": "15.19"
},
{
"author": "CNNVD",
"id": "CNNVD-200102-093",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-2863",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#739201"
},
{
"db": "CERT/CC",
"id": "VU#808633"
},
{
"db": "CERT/CC",
"id": "VU#872257"
},
{
"db": "CERT/CC",
"id": "VU#886953"
},
{
"db": "VULHUB",
"id": "VHN-2863"
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Memory leak in Cisco Catalyst 4000, 5000, and 6000 series switches allows remote attackers to cause a denial of service via a series of failed telnet authentication attempts. There is a buffer overflow in the IBM AIX setclock command that may allow local attackers to gain root privileges. Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability\n\nBy Sowhat of Nevis Labs\nDate: 2006.04.11\n\nhttp://www.nevisnetworks.com\nhttp://secway.org/advisory/AD20060411.txt\nhttp://www.microsoft.com/technet/security/bulletin/MS06-013.mspx\n\n\nCVE: CVE-2006-1189\n\nVendor\nMicrosoft Inc. \n\nProducts affected:\n\nInternet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4\n\tand Microsoft Windows XP Service Pack 1\nInternet Explorer 6 for Microsoft Windows XP Service Pack 2\nInternet Explorer 6 for Microsoft Windows Server 2003\nInternet Explorer 6 Service Pack 1 on Microsoft Windows 98, Microsoft\n\tWindows 98 SE, and Microsoft Windows Millennium Edition\n\n\n\nThis vulnerability affects systems that use Double-Byte Character Sets. \nSystems that are affected are Windows language versions that use a\nDouble Byte Character Set language. Examples of languages that use DBCS\nare Chinese, Japanese, and Korean languages. Customers using\nother language versions of Windows might also be affected if \"Language\nfor non-Unicode programs\" has been set to a Double Byte Character Set\nlanguage. \n\n\nOverview:\n\nThere exists a buffer overflow in Microsoft Internet Explorer in the\nparsing of DBCS URLS. \n\nThis vulnerability could allow an attacker to execute arbitrary code on the\nvictim\u0027s system when the victim visits a web page or views an HTML email\nmessage. \n\nThis attack may be utilized wherever IE parses HTML, such as webpages, email,\nnewsgroups, and within applications utilizing web-browsing functionality. \n\n\nDetails:\n\nURLMON.DLL does not properly validate IDN containing double-byte character\nsets (DBCS), which may lead to remote code execution. \n\nExploiting this vulnerability seems to need a lot of more work but we\nbelieve that\nexploitation is possible. \n\n\nPOC:\n\nNo PoC will be released for this. \n\n\nFIX:\n\nMicrosoft has released an update for Internet Explorer which is\nset to address this issue. This can be downloaded from:\n\nhttp://www.microsoft.com/technet/security/bulletin/MS06-013.mspx\n\n\nVendor Response:\n\n2005.12.29 Vendor notified via secure@microsoft.com\n2005.12.29 Vendor responded\n2006.04.11 Vendor released MS06-0xx patch\n2006.04.11 Advisory released\n\n\nCommon Vulnerabilities and Exposures (CVE) Information:\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned\nthe following names to these issues. These are candidates for\ninclusion in the CVE list (http://cve.mitre.org), which standardizes\nnames for security problems. \n\n\n CVE-2006-1189\n\n\nGreetings to Lennart@MS, Chi, OYXin, Narasimha Datta, all Nevis Labs guys,\n all XFocus and 0x557 guys :)\n\n\nReferences:\n\n1. http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx\n2. http://www.nsfocus.com/english/homepage/research/0008.htm\n3. http://xforce.iss.net/xforce/xfdb/5729\n4. http://www.securityfocus.com/bid/2100/discuss\n5. http://www.inter-locale.com/whitepaper/IUC27-a303.html\n6. http://blogs.msdn.com/michkap/archive/2005/10/28/486034.aspx\n7. [Mozilla Firefox IDN \"Host:\" Buffer Overflow]\n http://www.security-protocols.com/advisory/sp-x17-advisory.txt\n8. [Mozilla Firefox 1.5 Beta 1 IDN Buffer Overflow]\n http://www.security-protocols.com/advisory/sp-x18-advisory.txt\n9. http://72.14.203.104/search?q=cache:Dxn-V4fil1IJ:developer.novell.com\n\t /research/devnotes/1995/may/02/05.htm\n\n\n\n\n\n\n\n--\nSowhat\nhttp://secway.org\n\"Life is like a bug, Do you know how to exploit it ?\"\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2001-0041"
},
{
"db": "CERT/CC",
"id": "VU#739201"
},
{
"db": "CERT/CC",
"id": "VU#808633"
},
{
"db": "CERT/CC",
"id": "VU#872257"
},
{
"db": "CERT/CC",
"id": "VU#886953"
},
{
"db": "VULHUB",
"id": "VHN-2863"
},
{
"db": "PACKETSTORM",
"id": "45442"
}
],
"trust": 3.96
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-2863",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-2863"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "OSVDB",
"id": "801",
"trust": 1.7
},
{
"db": "NVD",
"id": "CVE-2001-0041",
"trust": 1.7
},
{
"db": "BID",
"id": "2072",
"trust": 1.7
},
{
"db": "BID",
"id": "2035",
"trust": 0.8
},
{
"db": "XF",
"id": "5618",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#739201",
"trust": 0.8
},
{
"db": "BID",
"id": "2033",
"trust": 0.8
},
{
"db": "XF",
"id": "5620",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#808633",
"trust": 0.8
},
{
"db": "BID",
"id": "2034",
"trust": 0.8
},
{
"db": "XF",
"id": "5619",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#872257",
"trust": 0.8
},
{
"db": "BID",
"id": "2032",
"trust": 0.8
},
{
"db": "XF",
"id": "5621",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#886953",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093",
"trust": 0.7
},
{
"db": "CISCO",
"id": "20001206 CISCO CATALYST MEMORY LEAK VULNERABILITY",
"trust": 0.6
},
{
"db": "XF",
"id": "5656",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "20473",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-74350",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-2863",
"trust": 0.1
},
{
"db": "XF",
"id": "5729",
"trust": 0.1
},
{
"db": "BID",
"id": "2100",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "45442",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#739201"
},
{
"db": "CERT/CC",
"id": "VU#808633"
},
{
"db": "CERT/CC",
"id": "VU#872257"
},
{
"db": "CERT/CC",
"id": "VU#886953"
},
{
"db": "VULHUB",
"id": "VHN-2863"
},
{
"db": "PACKETSTORM",
"id": "45442"
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"id": "VAR-200102-0077",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-2863"
}
],
"trust": 0.01
},
"last_update_date": "2024-07-23T21:24:52.601000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-2863"
},
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/2072"
},
{
"trust": 1.7,
"url": "http://www.cisco.com/warp/public/707/catalyst-memleak-pub.shtml"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/801"
},
{
"trust": 1.6,
"url": "http://techsupport.services.ibm.com/rs6000/aix.uhuic_getrec?args=dvhuron.boulder.ibm.com+dbaix+da139925+stiy08143+usbin"
},
{
"trust": 1.6,
"url": "http://techsupport.services.ibm.com/support/rs6000.support/fixsearch?fixdb=aix4\u0026srchtype=apar\u0026query=iy08143"
},
{
"trust": 1.6,
"url": "http://techsupport.services.ibm.com/rs6000/aix.uhuic_getrec?args=dvhuron.boulder.ibm.com+dbaix+da137627+stiy08287+usbin"
},
{
"trust": 1.6,
"url": "http://techsupport.services.ibm.com/support/rs6000.support/fixsearch?fixdb=aix4\u0026srchtype=apar\u0026query=iy08287"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/5656"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/2035"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/static/5618.php"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/rs6000/aix.uhuic_getrec?args=dvhuron.boulder.ibm.com+dbaix+da139817+stiy07831+usbin"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/support/rs6000.support/fixsearch?fixdb=aix4\u0026srchtype=apar\u0026query=iy07831"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/rs6000/aix.uhuic_getrec?args=dvhuron.boulder.ibm.com+dbaix+da137621+stiy07790+usbin"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/support/rs6000.support/fixsearch?fixdb=aix4\u0026srchtype=apar\u0026query=iy07790"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/2033"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/static/5620.php"
},
{
"trust": 0.8,
"url": "http://www.rs6000.ibm.com/idd500/usr/share/man/info/en_us/a_doc_lib/cmds/aixcmds2/digest.htm#a26p05a6"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/2034"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/static/5619.php"
},
{
"trust": 0.8,
"url": "http://www.rs6000.ibm.com/idd500/usr/share/man/info/en_us/a_doc_lib/cmds/aixcmds2/enq.htm#a200977f"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/2032"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/static/5621.php"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/rs6000/aix.uhuic_getrec?args=dvhuron.boulder.ibm.com+dbaix+da114623+stiy10721+usbin"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/support/rs6000.support/fixsearch?fixdb=aix4\u0026srchtype=apar\u0026query=iy10721"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/rs6000/aix.uhuic_getrec?args=dvhuron.boulder.ibm.com+dbaix+da123587+stiy08812+usbin"
},
{
"trust": 0.8,
"url": "http://techsupport.services.ibm.com/support/rs6000.support/fixsearch?fixdb=aix4\u0026srchtype=apar\u0026query=iy08812"
},
{
"trust": 0.8,
"url": "http://www.rs6000.ibm.com/doc_link/en_us/a_doc_lib/cmds/aixcmds5/setsenv.htm#wpg2f0frit"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/static/5656.php"
},
{
"trust": 0.1,
"url": "http://www.inter-locale.com/whitepaper/iuc27-a303.html"
},
{
"trust": 0.1,
"url": "http://xforce.iss.net/xforce/xfdb/5729"
},
{
"trust": 0.1,
"url": "http://www.security-protocols.com/advisory/sp-x17-advisory.txt"
},
{
"trust": 0.1,
"url": "http://www.nsfocus.com/english/homepage/research/0008.htm"
},
{
"trust": 0.1,
"url": "http://www.microsoft.com/technet/security/bulletin/ms06-013.mspx"
},
{
"trust": 0.1,
"url": "http://www.nevisnetworks.com"
},
{
"trust": 0.1,
"url": "http://blogs.msdn.com/michkap/archive/2005/10/28/486034.aspx"
},
{
"trust": 0.1,
"url": "http://www.security-protocols.com/advisory/sp-x18-advisory.txt"
},
{
"trust": 0.1,
"url": "http://secway.org"
},
{
"trust": 0.1,
"url": "http://www.securityfocus.com/bid/2100/discuss"
},
{
"trust": 0.1,
"url": "http://secway.org/advisory/ad20060411.txt"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org),"
},
{
"trust": 0.1,
"url": "http://72.14.203.104/search?q=cache:dxn-v4fil1ij:developer.novell.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#739201"
},
{
"db": "CERT/CC",
"id": "VU#808633"
},
{
"db": "CERT/CC",
"id": "VU#872257"
},
{
"db": "CERT/CC",
"id": "VU#886953"
},
{
"db": "VULHUB",
"id": "VHN-2863"
},
{
"db": "PACKETSTORM",
"id": "45442"
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#739201"
},
{
"db": "CERT/CC",
"id": "VU#808633"
},
{
"db": "CERT/CC",
"id": "VU#872257"
},
{
"db": "CERT/CC",
"id": "VU#886953"
},
{
"db": "VULHUB",
"id": "VHN-2863"
},
{
"db": "PACKETSTORM",
"id": "45442"
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#739201"
},
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#808633"
},
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#872257"
},
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#886953"
},
{
"date": "2001-02-16T00:00:00",
"db": "VULHUB",
"id": "VHN-2863"
},
{
"date": "2006-04-14T01:00:47",
"db": "PACKETSTORM",
"id": "45442"
},
{
"date": "2001-02-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"date": "2001-02-16T05:00:00",
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#739201"
},
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#808633"
},
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#872257"
},
{
"date": "2001-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#886953"
},
{
"date": "2017-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-2863"
},
{
"date": "2005-05-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200102-093"
},
{
"date": "2017-10-10T01:29:33.373000",
"db": "NVD",
"id": "CVE-2001-0041"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "45442"
},
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM AIX setclock buffer overflow in remote timeserver argument",
"sources": [
{
"db": "CERT/CC",
"id": "VU#739201"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200102-093"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.