Vulnerability Details : CVE-2006-1359
Public exploit exists!
Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.
Vulnerability category: Execute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2006-1359
Probability of exploitation activity in the next 30 days: 97.33%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2006-1359
-
MS06-013 Microsoft Internet Explorer createTextRange() Code Execution
Disclosure Date: 2006-03-19First seen: 2020-04-26exploit/windows/browser/ms06_013_createtextrangeThis module exploits a code execution vulnerability in Microsoft Internet Explorer. Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point
CVSS scores for CVE-2006-1359
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2006-1359
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2006-1359
-
http://www.securityfocus.com/archive/1/429124/30/6120/threaded
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1678
-
http://www.us-cert.gov/cas/techalerts/TA06-101A.html
US Government Resource
-
http://www.securityfocus.com/bid/17196
Microsoft Internet Explorer CreateTextRange Remote Code Execution VulnerabilityExploit
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-013
-
http://www.kb.cert.org/vuls/id/876678
US Government Resource
-
http://www.microsoft.com/technet/security/advisory/917077.mspx
-
http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1662.html
-
http://securitytracker.com/id?1015812
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1178
-
http://www.securityfocus.com/archive/1/428441
-
http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1427.html
-
http://www.vupen.com/english/advisories/2006/1050
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1657
-
http://www.computerterrorism.com/research/ct22-03-2006
Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A985
-
http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1430.html
-
http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1434.html
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1702
- http://www.vupen.com/english/advisories/2006/1318
-
http://www.securityfocus.com/archive/1/429088/100/0/threaded
-
http://www.securityfocus.com/archive/1/428600/100/0/threaded
-
http://www.ciac.org/ciac/bulletins/q-154.shtml
-
http://www.securityfocus.com/archive/1/428583/100/0/threaded
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/25379
Products affected by CVE-2006-1359
- cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:ie:6.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:ie:7.0:beta_2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*