Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
References
Link Resource
http://isc.sans.org/diary.php?date=2005-08-18 Third Party Advisory
http://secunia.com/advisories/16480 Patch Vendor Advisory
http://secunia.com/advisories/17172 Permissions Required Third Party Advisory
http://secunia.com/advisories/17223 Permissions Required Third Party Advisory
http://secunia.com/advisories/17509 Permissions Required Third Party Advisory
http://securityreason.com/securityalert/72 Third Party Advisory
http://securitytracker.com/id?1014727 Exploit Patch Vendor Advisory Third Party Advisory VDB Entry
http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf Third Party Advisory
http://www.kb.cert.org/vuls/id/740372 Third Party Advisory US Government Resource
http://www.kb.cert.org/vuls/id/898241 Third Party Advisory US Government Resource
http://www.kb.cert.org/vuls/id/959049 Third Party Advisory US Government Resource
http://www.microsoft.com/technet/security/advisory/906267.mspx Mitigation Patch Vendor Advisory
http://www.securityfocus.com/archive/1/470690/100/0/threaded
http://www.securityfocus.com/bid/14594 Exploit Patch VDB Entry Third Party Advisory
http://www.securityfocus.com/bid/15061 Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA05-284A.html Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA05-347A.html Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA06-220A.html Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2005/1450 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-052
https://exchange.xforce.ibmcloud.com/vulnerabilities/21895 VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34754 VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1155
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1454
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1464
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1468
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1535
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1538
History

No history.

cve-icon MITRE Information

Status: PUBLISHED

Assigner: microsoft

Published: 2005-08-19T04:00:00

Updated: 2018-10-19T14:57:01

Reserved: 2005-07-02T00:00:00


Link: CVE-2005-2127

JSON object: View

cve-icon NVD Information

Status : Modified

Published: 2005-08-19T04:00:00.000

Modified: 2018-10-19T15:32:34.783


Link: CVE-2005-2127

JSON object: View

cve-icon Redhat Information

No data.

CWE