Microsoft XMLHTTP ActiveX control code execution
| ie-xml-http-request-handling (30004) |  High Risk |
Description:
Microsoft Internet Explorer could allow a remote attacker to execute code on a victim's system, caused by an unspecified vulnerability in the Microsoft XML Core Services XMLHTTP ActiveX control. A remote attacker could exploit this vulnerability to execute arbitrary code on a victim's system, if the attacker could persuade the victim to visit a Web page containing a malicious XMLHTTP ActiveX control.
Platforms Affected:
- Microsoft, XML Core Services 4.0
- Microsoft, XML Core Services 6.0
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS06-071. See References.
Consequences:
Gain Access
References:
- Internet Security Systems Protection Alert November 4, 2006, Vulnerability in Microsoft XML HTTP Request Handling at http://xforce.iss.net/xforce/alerts/id/239.
- Microsoft Security Advisory (927892), Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution at http://www.microsoft.com/technet/security/advisory/927892.mspx.
- Microsoft Security Bulletin MS06-071, Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (928088) at http://www.microsoft.com/technet/security/bulletin/ms06-071.mspx.
- Microsoft Security Bulletin MS07-042, Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (936227) at http://www.microsoft.com/technet/security/bulletin/ms07-042.mspx.
- ASA-2006-253: Microsoft Security Bulletin Summary for November 2006 (MS06-66 - MS06-71)
- BID-20915: Microsoft XML Core Service XMLHTTP ActiveX Control Remote Code Execution Vulnerability
- CVE-2006-5745: Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information.
- SA22687: Microsoft XMLHTTP ActiveX Control Code Execution Vulnerability
- SECTRACK ID: 1017157: Microsoft XML Core Services ActiveX Control Lets Remote Users Execute Arbitrary Code
- US-CERT VU#585137: Microsoft XML Core Services XMLHTTP ActiveX control vulnerability
- VUPEN/ADV-2006-4334: Microsoft XML Core Services XMLHTTP Code Execution Vulnerability (MS06-071)
Reported:
Nov 03, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net