HTTP: Dangerous ClassID in ActiveX Object Type 103

This signature detects attempts to exploit a known vulnerability against Internet Explorer. Malicious Web sites, containing dangerous ActiveX CLSID references, can exploit this vulnerability and gain control of client browsers.

Extended Description

Microsoft Internet Explorer is prone to a memory-corruption vulnerability that is related to the instantiation of COM objects. This issue results from a design error. The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in arbitrary code execution. The affected objects are not intended to be instantiated through Internet Explorer. This BID is related to the issues described in BID 14511 (Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability) and BID 15061 Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability). However, this issue affects a different set of COM objects that were not addressed in the previous BIDs.

Affected Products

Microsoft internet_explorer

References

BugTraq: 17453

CVE: CVE-2006-1186

URL: http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx

Short Name

HTTP:STC:CLSID:ACTIVEX:AX-103

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Dangerous ClassID in ActiveX Object Type 103

Extended Description

Affected Products

References

Found a potential security threat?