| Vulnerability Name: | CVE-2006-1359 (CCN-25379) | ||||||||||||||||||||||||
| Assigned: | 2006-03-22 | ||||||||||||||||||||||||
| Published: | 2006-03-22 | ||||||||||||||||||||||||
| Updated: | 2021-07-23 | ||||||||||||||||||||||||
| Summary: | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-94 | ||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||
| References: | Source: CCN Type: Full-Disclosure Mailing List, Wed Mar 22 2006 - 03:13:27 CST IE crash Source: FULLDISC Type: UNKNOWN 20060322 IE crash Source: CCN Type: Full-Disclosure Mailing List, Wed Mar 22 2006 - 09:33:26 CST Microsoft Internet Explorer (mshtml.dll) - Remote Code Execution Source: FULLDISC Type: UNKNOWN 20060322 Microsoft Internet Explorer (mshtml.dll) - Remote Code Execution Source: FULLDISC Type: UNKNOWN 20060322 FW: [Full-disclosure] IE crash Source: FULLDISC Type: UNKNOWN 20060327 Determina Fix for the IE createTextRange() bug Source: CCN Type: Microsoft Security Response Center Blog, Wednesday, March 22, 2006 9:18 PM New publicly disclosed vulnerability in Internet Explorer Source: MITRE Type: CNA CVE-2006-1359 Source: CCN Type: SA18680 Microsoft Internet Explorer "createTextRange()" Code Execution Source: SECUNIA Type: Vendor Advisory 18680 Source: MISC Type: UNKNOWN http://secunia.com/secunia_research/2006-7/advisory/ Source: CCN Type: SECTRACK ID: 1015812 Microsoft Internet Explorer createTextRange() Memory Error Lets Remote Users Execute Arbitrary Code Source: SECTRACK Type: UNKNOWN 1015812 Source: CCN Type: ASA-2006-079 Windows Security Updates for April 2006 - (MS06-013 - MS06-017) Source: CCN Type: Microsoft Security Advisory (917077) Vulnerability in the way HTML Objects Handle Unexpected Method Calls Could Allow Remote Code Execution Source: CIAC Type: UNKNOWN Q-154 Source: MISC Type: Vendor Advisory http://www.computerterrorism.com/research/ct22-03-2006 Source: CCN Type: US-CERT VU#876678 Microsoft Internet Explorer createTextRange() vulnerability Source: CERT-VN Type: US Government Resource VU#876678 Source: CONFIRM Type: UNKNOWN http://www.microsoft.com/technet/security/advisory/917077.mspx Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: OSVDB Type: UNKNOWN 24050 Source: CCN Type: OSVDB ID: 24050 Microsoft IE createTextRange() Function Arbitrary Code Execution Source: BUGTRAQ Type: UNKNOWN 20060322 IE crash Source: BUGTRAQ Type: UNKNOWN 20060322 Microsoft Internet Explorer (mshtml.dll) - Remote Code Execution Source: BUGTRAQ Type: UNKNOWN 20060323 Secunia Research: Microsoft Internet Explorer "createTextRange()"Code Execution Source: BUGTRAQ Type: UNKNOWN 20060328 EEYE: Temporary workaround for IE createTextRange vulnerability Source: BUGTRAQ Type: UNKNOWN 20060328 Determina Fix for CVE-2006-1359 (Zero Day MS Internet Explorer Remote "CreateTextRange()" Code Execution) Source: BID Type: Exploit 17196 Source: CCN Type: BID-17196 Microsoft Internet Explorer CreateTextRange Remote Code Execution Vulnerability Source: CCN Type: US-CERT Technical Cyber Security Alert TA06-101A Microsoft Windows and Internet Explorer Vulnerabilities Source: CERT Type: US Government Resource TA06-101A Source: VUPEN Type: UNKNOWN ADV-2006-1050 Source: VUPEN Type: UNKNOWN ADV-2006-1318 Source: CCN Type: Internet Security Systems Protection Alert March 24, 2006 Microsoft IE createTextRange() Remote Command Execution Source: CCN Type: Internet Security Systems Protection Alert - April 11, 2006 Cumulative Security Update for Internet Explorer Source: MS Type: UNKNOWN MS06-013 Source: XF Type: UNKNOWN ie-createtextrange-command-execution(25379) Source: XF Type: UNKNOWN ie-createtextrange-command-execution(25379) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:1178 Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:1657 Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:1678 Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:1702 Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:985 | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||