HTTP: Dangerous ClassID in ActiveX Object Type 117

This signature detects attempts to exploit a known vulnerability against Internet Explorer. Malicious Web sites, containing dangerous ActiveX CLSID references, can exploit this vulnerability and gain control of client browsers.

Extended Description

Microsoft Internet Explorer is prone to a memory-corruption vulnerability that is related to the instantiation of COM objects. This issue results from a design error. The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in arbitrary code execution. The affected objects are not intended to be instantiated through Internet Explorer. This BID is related to the issues described in BID 14511 (Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability), BID 15061 (Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability), and BID 17453 (Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability). However, this issue affects a different set of COM objects that were not addressed in the previous BIDs.

Affected Products

Microsoft internet_explorer

References

BugTraq: 18328

CVE: CVE-2006-1303

URL: http://www.microsoft.com/technet/security/bulletin/MS06-021.mspx

Short Name

HTTP:STC:CLSID:ACTIVEX:AX-117

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Dangerous ClassID in ActiveX Object Type 117

Extended Description

Affected Products

References

Found a potential security threat?