Vulnerability Name:

CVE-2004-0978 (CCN-17714)

Assigned:2004-10-12
Published:2004-10-12
Updated:2020-12-09
Summary:Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6, when users who visit online gaming sites that are associated with MSN, allows remote attackers to execute arbitrary code via the SetupData parameter.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Wed Oct 13 2004 - 09:37:26 CDT
MSN Gaming Heartbeat Component Buffer Overflow

Source: MITRE
Type: CNA
CVE-2004-0978

Source: BUGTRAQ
Type: Issue Tracking, Third Party Advisory
20050119 MSN Heartbeat Control Buffer Overflow

Source: CCN
Type: US-CERT VU#673134
Microsoft MSN Hrtbeat.ocx ActiveX control contains unspecified vulnerability

Source: CERT-VN
Type: Third Party Advisory, US Government Resource
VU#673134

Source: CCN
Type: Microsoft Security Bulletin MS04-038
Cumulative Security Update for Internet Explorer (834707)

Source: CCN
Type: Microsoft Security Bulletin MS04-040
Cumulative Security Update for Internet Explorer (889293)

Source: CCN
Type: Microsoft Security Bulletin MS05-014
Cumulative Security Update for Internet Explorer (867282)

Source: CCN
Type: Microsoft Security Bulletin MS05-020
Cumulative Security Update for Internet Explorer (890923)

Source: CCN
Type: Microsoft Security Bulletin MS05-025
Cumulative Security Update for Internet Explorer (883939)

Source: CCN
Type: Microsoft Security Bulletin MS05-038
Cumulative Security Update for Internet Explorer (896727)

Source: CCN
Type: Microsoft Security Bulletin MS05-052
Cumulative Security Update for Internet Explorer (896688)

Source: CCN
Type: Microsoft Security Bulletin MS05-054
Cumulative Security Update for Internet Explorer (905915)

Source: CCN
Type: Microsoft Security Bulletin MS06-004
Cumulative Security Update for Internet Explorer (910620)

Source: CCN
Type: Microsoft Security Bulletin MS06-013
Cumulative Security Update for Internet Explorer (912812)

Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)

Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)

Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)

Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)

Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)

Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)

Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)

Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)

Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)

Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)

Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)

Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)

Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)

Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)

Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)

Source: CCN
Type: NGSSoftware Insight Security Research Advisory #NISR19012005d
MSN Heartbeat Control Buffer Overflow

Source: MISC
Type: Broken Link
http://www.ngssoftware.com/advisories/heartbeatfull.txt

Source: CCN
Type: OSVDB ID: 10756
Microsoft MSN heartbeat.ocx Component Overflow

Source: BID
Type: Third Party Advisory, VDB Entry
11367

Source: CCN
Type: BID-11367
Microsoft Internet Explorer Heartbeat ActiveX Control Unspecified Vulnerability

Source: MS
Type: Patch, Vendor Advisory
MS04-038

Source: XF
Type: Third Party Advisory, VDB Entry
heartbeat-activex(17714)

Source: XF
Type: UNKNOWN
heartbeat-activex(17714)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:internet_explorer:5.01:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2000:-:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_me:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:microsoft:internet_explorer:6:-:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_xp:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:-:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_xp:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2000:-:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_98se:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_me:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:terminal_server:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp1:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:ie:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft internet explorer 5.01 sp3
    microsoft internet explorer 5.01 sp4
    microsoft windows 2000 - sp3
    microsoft windows 2000 - sp4
    microsoft internet explorer 5.5 sp2
    microsoft windows me -
    microsoft internet explorer 6 -
    microsoft windows server 2003 -
    microsoft windows server 2003 -
    microsoft windows xp -
    microsoft windows xp - -
    microsoft windows xp - sp1
    microsoft windows xp - sp2
    microsoft internet explorer 6 sp1
    microsoft windows 2000 - sp3
    microsoft windows 2000 - sp4
    microsoft windows 98se -
    microsoft windows me -
    microsoft windows nt 4.0 sp6
    microsoft windows nt 4.0 sp6a
    microsoft windows xp -
    microsoft windows xp - sp1
    microsoft ie *