Vulnerability Name: CVE-2006-4868 (CCN-29004) Assigned: 2006-09-19 Published: 2006-09-19 Updated: 2021-07-23 Summary: Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag. CVSS v3 Severity: 5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): HighPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): LowIntegrity (I): LowAvailibility (A): Low
CVSS v2 Severity: 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C 7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P 4.2 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): HighAthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
Vulnerability Type: CWE-119 Vulnerability Consequences: Gain Access References: Source: CCNvml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit http://blogs.securiteam.com/index.php/archives/624 CVE-2006-4868 Introduction to Vector Markup Language (VML) Microsoft Vector Graphics Rendering Library Buffer Overflow 21989 Microsoft Internet Explorer VML Buffer Overflow Lets Remote Users Execute Arbitrary Code 1016879 http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-being.html Vulnerability in Vector Markup Language Could Allow Remote Code Execution (MS06-055) 925486 Vulnerability in Microsoft Excel Could Allow Remote Code Execution (2640241) Vulnerability in Microsoft Office Could Allow for Remote Code Execution (2639185) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578) Vulnerability in Microsoft Office Could Allow for Remote Code Execution (2731879) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2742319) Vulnerability in Microsoft Works Could Allow Remote Code Execution (KB2754670) Vulnerability in SQL Server Could Allow Elevation of Privilege (2754849) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2780642) Vulnerability in Silverlight Could Allow Remote Code Execution (2814124) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2830399) Vulnerability in Windows Components Could Allow Remote Code Execution (2848295) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2885080) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2885084) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2916605) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2949660) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2969261) Vulnerability in Windows Journal Could Allow Remote Code Execution (2975689) Vulnerabilities in SQL Server Could Allow Elevation of Privilege (2984340) Vulnerability in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (3000434) Vulnerability in Microsoft Office Could Allow Remote Code Execution (3009710) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (3017301) Vulnerabilities in MicrosoftExcel Could Allow Remote Code Execution (3017347) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3080790) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664) Security Updates for Microsoft Office (3096440) Security Updates for Microsoft Office to Address Remote Code Execution (3104540) Security Update for Microsoft Office to Address Remote Code Execution (3116111) Security Update for Microsoft Office to Address Remote Code Execution - Critical (3124585) Security Update for Microsoft Office to Address Remote Code Execution (3134226) Security Update for Microsoft Office to Address Remote Code Execution (3141806) Security Update for Microsoft Office (3148775) Security Update for Microsoft Office (3155544) Security Update for Office (3163610) Security Updates for Office (3170008) Security Update for Office (3177451) Security Update for Microsoft Office (3185852) Security Update for Microsoft Office (3194063) Security Update for Microsoft Office (3199168) Security Update for Microsoft Office (3204068) Security Update for Microsoft Office (3214291) Security Update for Microsoft Graphics Component (4013075) Security Update for Microsoft Office (4013241) Microsoft Internet Explorer VML stack buffer overflow VU#416092 Vulnerability in Vector Markup Language Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/925568.mspx Vulnerability in Vector Markup Language Could Allow Remote Code Execution (925486) Vulnerability in Vector Markup Language Could Allow Remote Code Execution (929969) Vulnerability in Vector Markup Language Could Allow Remote Code Execution (938127) Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593) Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420) Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340) Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488) Vulnerability in Microsoft Office (MSO) Could Allow Remote Code Execution (978214) Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (975416) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (980094) Vulnerabilities in COM validation in Microsoft Office Could Allow Remote Code Execution (983235 Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (2269638) Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2293194) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930) Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution (968095) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2451879) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293) Vulnerability in GDI+ Could Allow Remote Code Execution (2489979) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2537146) Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2560978) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2587505) 28946 Microsoft IE Vector Markup Language (VML) Arbitrary Code Execution 20060919 Yet another 0day for IE 20060920 vml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit 20060920 RE: vml.c - Internet Explorer VML Buffer Overflow Download Exec Exploit 20060920 Internet Explorer VML Zero-Day Mitigation 20060924 Windows VML Vulnerability FAQ (CVE-2006-4868) written 20060926 Windows VML security update MS06-055 released SSRT061254 20096 Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability TA06-262A ADV-2006-3679 Vector Markup Language (VML) Microsoft Internet Explorer Vector Markup Language Exploit Alert MS06-055 ie-vml-bo(29004) ie-vml-bo(29004) oval:org.mitre.oval:def:100 MS06-055 Microsoft Internet Explorer VML Fill Method Code Execution Vulnerable Configuration: Configuration 1 :cpe:/o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:*:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:gold:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:* AND cpe:/a:microsoft:outlook:2003:*:*:*:*:*:*:* OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:* Configuration 2 :cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* AND cpe:/a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:* AND cpe:/o:microsoft:windows_xp::sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:* OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:* OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:* OR cpe:/o:microsoft:windows_2003_server:::itanium:*:*:*:*:* OR cpe:/o:microsoft:windows:2003_server:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_xp:::x64:*:professional:*:*:* OR cpe:/o:microsoft:windows:2003_server:sp1_itanium:*:*:*:*:*:* Oval Definitions BACK
microsoft windows 2003 server * sp1
microsoft windows xp *
microsoft windows xp * sp1
microsoft windows xp * sp2
microsoft windows 2003 server *
microsoft windows 2003 server * gold
microsoft windows 2000 * sp4
microsoft windows 2003 server *
microsoft windows 2003 server *
microsoft outlook 2003
microsoft internet explorer 6.0
microsoft windows 2000 * sp4
microsoft internet explorer 5.0.1 sp4
microsoft ie 6.0 sp1
microsoft internet explorer 5.01 sp4
microsoft windows xp sp1
microsoft windows 2000 sp4
microsoft windows 2003_server
microsoft windows xp sp2
microsoft windows 2003 server
microsoft windows 2003_server sp1
microsoft windows xp
microsoft windows 2003_server sp1_itanium
Denotes that component is vulnerable