Executive Summary

Informations
Name	MS05-054	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Cumulative Security Update for Internet Explorer (905915)

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-399	Resource Management Errors

OVAL Definitions

 

Definition Id: oval:org.mitre.oval:def:1091
Oval ID:	oval:org.mitre.oval:def:1091
Title:	Server 2003 IE Mismatched Document Object Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1790	Version:	8
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.449 AND NOT Win2K/XP/2003 is patched AND Server 2003 IE Enhanced Security is installed and set. Server 2003 IE Enhanced Security (Administror) is installed and set. AND Server 2003 IE Enhanced Security (User) is installed and set.

 

Definition Id: oval:org.mitre.oval:def:1097
Oval ID:	oval:org.mitre.oval:def:1097
Title:	Win2K/XP,SP1 HTTPS Proxy Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2830	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1528

 

Definition Id: oval:org.mitre.oval:def:1101
Oval ID:	oval:org.mitre.oval:def:1101
Title:	WinXP,SP1 (64-bit) HTTPS Proxy Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2830	Version:	7
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 64-bit with Service Pack 1 Windows XP is installed AND 64-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2577

 

Definition Id: oval:org.mitre.oval:def:1143
Oval ID:	oval:org.mitre.oval:def:1143
Title:	Server 2003,SP1 HTTPS Proxy Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2830	Version:	7
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.2577 AND Win2K/XP/2003 service pack 1 is installed

 

Definition Id: oval:org.mitre.oval:def:1209
Oval ID:	oval:org.mitre.oval:def:1209
Title:	Server 2003,SP1 File Download Dialog Box Manipulation Vulnerability
Description:	Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2829	Version:	7
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.2577 AND Win2K/XP/2003 service pack 1 is installed

 

Definition Id: oval:org.mitre.oval:def:1299
Oval ID:	oval:org.mitre.oval:def:1299
Title:	WinXP,SP2 IE Mismatched Document Object Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1790	Version:	8
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 32 bit Service Pack 2 Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.2900.2802

 

Definition Id: oval:org.mitre.oval:def:1303
Oval ID:	oval:org.mitre.oval:def:1303
Title:	WinXP,SP1 (64-bit) IE Mismatched Document Object Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1790	Version:	7
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 64-bit with Service Pack 1 Windows XP is installed AND 64-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2577

 

Definition Id: oval:org.mitre.oval:def:1317
Oval ID:	oval:org.mitre.oval:def:1317
Title:	Server 2003 HTTPS Proxy Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2830	Version:	7
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.449 AND NOT Win2K/XP/2003 is patched

 

Definition Id: oval:org.mitre.oval:def:1340
Oval ID:	oval:org.mitre.oval:def:1340
Title:	WinXP,SP1 (64-bit) File Download Dialog Box Manipulation Vulnerability
Description:	Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2829	Version:	7
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 64-bit with Service Pack 1 Windows XP is installed AND 64-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2577

 

Definition Id: oval:org.mitre.oval:def:1426
Oval ID:	oval:org.mitre.oval:def:1426
Title:	WinXP,SP2 COM Object Instantiation Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2831	Version:	8
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 32 bit Service Pack 2 Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.2900.2802

 

Definition Id: oval:org.mitre.oval:def:1435
Oval ID:	oval:org.mitre.oval:def:1435
Title:	WinXP,SP2 HTTPS Proxy Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2830	Version:	8
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 32 bit Service Pack 2 Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.2900.2802

 

Definition Id: oval:org.mitre.oval:def:1458
Oval ID:	oval:org.mitre.oval:def:1458
Title:	Server 2003 File Download Dialog Box Manipulation Vulnerability
Description:	Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2829	Version:	7
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.449 AND NOT Win2K/XP/2003 is patched

 

Definition Id: oval:org.mitre.oval:def:1475
Oval ID:	oval:org.mitre.oval:def:1475
Title:	Server 2003 COM Object Instantiation Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2831	Version:	7
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.449 AND NOT Win2K/XP/2003 is patched

 

Definition Id: oval:org.mitre.oval:def:1489
Oval ID:	oval:org.mitre.oval:def:1489
Title:	Win2k,SP4 IE Mismatched Document Object Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1790	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3835.2200

 

Definition Id: oval:org.mitre.oval:def:1490
Oval ID:	oval:org.mitre.oval:def:1490
Title:	Win2K,SP4 File Download Dialog Box Manipulation Vulnerability
Description:	Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2829	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3835.2200

 

Definition Id: oval:org.mitre.oval:def:1505
Oval ID:	oval:org.mitre.oval:def:1505
Title:	Win2K/XP,SP1 File Download Dialog Box Manipulation Vulnerability
Description:	Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2829	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1528

 

Definition Id: oval:org.mitre.oval:def:1507
Oval ID:	oval:org.mitre.oval:def:1507
Title:	WinXP,SP2 File Download Dialog Box Manipulation Vulnerability
Description:	Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then (2) using a keyboard shortcut and delaying the display of the file download box until the user hits a shortcut that activates the "Run" button, aka "File Download Dialog Box Manipulation Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2829	Version:	8
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 32 bit Service Pack 2 Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.2900.2802

 

Definition Id: oval:org.mitre.oval:def:1508
Oval ID:	oval:org.mitre.oval:def:1508
Title:	Server 2003,SP1 IE Mismatched Document Object Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1790	Version:	8
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.2577 AND Win2K/XP/2003 service pack 1 is installed AND Server 2003 IE Enhanced Security is installed and set. Server 2003 IE Enhanced Security (Administror) is installed and set. AND Server 2003 IE Enhanced Security (User) is installed and set.

 

Definition Id: oval:org.mitre.oval:def:1520
Oval ID:	oval:org.mitre.oval:def:1520
Title:	WinXP,SP1 (64-bit) COM Object Instantiation Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2831	Version:	7
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP 64-bit with Service Pack 1 Windows XP is installed AND 64-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2577

 

Definition Id: oval:org.mitre.oval:def:1521
Oval ID:	oval:org.mitre.oval:def:1521
Title:	Win2K,SP4 HTTPS Proxy Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive information, aka "HTTPS Proxy Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2830	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3835.2200

 

Definition Id: oval:org.mitre.oval:def:1543
Oval ID:	oval:org.mitre.oval:def:1543
Title:	Server 2003,SP1 COM Object Instantiation Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2831	Version:	7
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.3790.2577 AND Win2K/XP/2003 service pack 1 is installed

 

Definition Id: oval:org.mitre.oval:def:1558
Oval ID:	oval:org.mitre.oval:def:1558
Title:	Win2K,SP4 COM Object Instantiation Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2831	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3835.2200

 

Definition Id: oval:org.mitre.oval:def:1597
Oval ID:	oval:org.mitre.oval:def:1597
Title:	Win2K/XP,SP1 COM Object Instantiation Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, aka a variant of the "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2127.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-2831	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1528

 

Definition Id: oval:org.mitre.oval:def:722
Oval ID:	oval:org.mitre.oval:def:722
Title:	Win2K/XP,SP1 IE Mismatched Document Object Memory Corruption Vulnerability
Description:	Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1790	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1528

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Ie cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:ie:6.0:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*	3
Application	Microsoft Internet Explorer cpe:2.3:a:microsoft:internet_explorer:6.0.2900.2180:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6.0.2800.1106:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*	13

SAINT Exploits

Description	Link
Internet Explorer onload window vulnerability	More info here

ExploitDB Exploits

id	Description
2012-01-14	Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution V...

Open Source Vulnerability Database (OSVDB)

Id	Description
23657	Microsoft IE ActiveX Killbit Setting Bypass Microsoft Internet Explorer contains a flaw that may allow a malicious user to bypass the kill bit settings for ActiveX controls. The issue is triggered when user visits a malicious web page that contains specially crafted HTML which would cause the killbit setting for ActiveX controls to be bypassed. It is possible that the flaw may allow to execute arbitary code with user privileges.
21763	Microsoft IE Embedded CLSID COM Object Arbitrary Code Execution Microsoft Internet Explorer contains a flaw that may allow a malicious user to corrupt memory. The issue is triggered when the user accesses a maliciously crafted web page that instantiates COM objects which were not intended for use with IE, as ActiveX controls. It is possible that the flaw may allow for arbitrary code execution resulting in a loss of integrity.
21762	Microsoft IE HTTPS Proxy Basic Authentication URL Cleartext Transmission
21761	Microsoft IE Keyboard Shortcut Processing Weakness
21760	Microsoft IE Suppressed Download Dialog Window Manipulation Weakness
17094	Microsoft IE window() Function Arbitrary Code Execution Internet Explorer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue occurs when the browser does not properly handle requests to the window() object. A remote attacker could create a malicious website that uses an onload event to initialize a window() object, which may cause Internet Explorer to crash or execute arbitrary code with the privileges of the person running it.

Snort® IPS/IDS

Date	Description
2014-01-10	Microsoft Internet Explorer javascript onload prompt obfuscation overflow att... RuleID : 4917 - Revision : 16 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer javascript onload document.write obfuscation over... RuleID : 4916 - Revision : 15 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer Shortcut Handler ActiveX object access RuleID : 4915 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Script Definition ActiveX object access RuleID : 4914 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Workspace ActiveX object access RuleID : 4913 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Root ActiveX object access RuleID : 4912 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Type Library ActiveX object access RuleID : 4911 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Relationship Definition ActiveX object... RuleID : 4910 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Property Definition ActiveX object access RuleID : 4909 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Method Definition ActiveX object access RuleID : 4908 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Collection Definition ActiveX object a... RuleID : 4907 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Interface Definition ActiveX object ac... RuleID : 4906 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Object ActiveX object access RuleID : 4905 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Repository Alias ActiveX object access RuleID : 4904 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer VMR ImageSync 9 ActiveX object access RuleID : 4903 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Video Mixing Renderer 9 ActiveX object access RuleID : 4902 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer VMR Allocator Presenter 9 ActiveX object access RuleID : 4901 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Outlook Progress Ctl ActiveX object access RuleID : 4900 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer ISupportErrorInfo Interface ActiveX object access RuleID : 4899 - Revision : 17 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer PSTypeComp ActiveX object access RuleID : 4898 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer PSOAInterface ActiveX object access RuleID : 4897 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer PSTypeLib ActiveX object access RuleID : 4896 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer PSTypeInfo ActiveX object access RuleID : 4895 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer PSEnumVariant ActiveX object access RuleID : 4894 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer Trident HTMLEditor ActiveX object access RuleID : 4893 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer MTSEvents Class ActiveX object access RuleID : 4892 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer cfw Class ActiveX object access RuleID : 4891 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer IAVIStream & IAVIFile Proxy ActiveX object ac... RuleID : 4890 - Revision : 14 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer javascript onload overflow attempt RuleID : 4647 - Revision : 17 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer File Download Dialog Box Manipulation RuleID : 17463 - Revision : 13 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer HTTPS proxy information disclosure vulnerability RuleID : 17448 - Revision : 11 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer Address ActiveX clsid access RuleID : 11252 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10	Sony Rootkit Uninstaller ActiveX clsid unicode access RuleID : 11251 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10	Sony Rootkit Uninstaller ActiveX clsid access RuleID : 11250 - Revision : 12 - Type : BROWSER-PLUGINS
2014-01-10	IE Address ActiveX clsid unicode access RuleID : 11249 - Revision : 7 - Type : WEB-ACTIVEX

Metasploit Database

id	Description
2005-11-21	MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution

Nessus® Vulnerability Scanner

Date	Description
2006-02-14	Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms06-004.nasl - Type : ACT_GATHER_INFO
2005-12-13	Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms05-054.nasl - Type : ACT_GATHER_INFO

Alert History

Date	Informations
2020-05-23 13:17:12	Multiple Updates
2014-02-17 11:45:17	Multiple Updates
2014-01-19 21:29:57	Multiple Updates