National Cyber-Alert System

Vulnerability Summary for CVE-2005-2087

Overview

Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA05-193A

Name: TA05-193A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA05-193A.html

US-CERT Vulnerability Note: VU#939605

Name: VU#939605

Hyperlink:http://www.kb.cert.org/vuls/id/939605

US-CERT Vulnerability Note: VU#959049

Name: VU#959049

Hyperlink:http://www.kb.cert.org/vuls/id/959049

External Source: XF

Name: ie-javaprxydll-execute-code(21193)

Hyperlink:http://xforce.iss.net/xforce/xfdb/21193

External Source: BID

Name: 14087

Hyperlink:http://www.securityfocus.com/bid/14087

External Source: BUGTRAQ

Name: 20050702 Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit

Hyperlink:http://www.securityfocus.com/archive/1/404055

External Source: OSVDB

Name: 17680

Hyperlink:http://www.osvdb.org/17680

External Source: MS

Name: MS05-037

Hyperlink:http://www.microsoft.com/technet/Security/bulletin/ms05-037.mspx

External Source: MISC

Name: http://www.microsoft.com/technet/security/advisory/903144.mspx

Hyperlink:http://www.microsoft.com/technet/security/advisory/903144.mspx

External Source: VUPEN

Name: ADV-2005-0935

Hyperlink:http://www.frsirt.com/english/advisories/2005/0935

External Source: AUSCERT

Name: ESB-2005.0489

Hyperlink:http://www.auscert.org.au/render.html?it=5225

External Source: SECTRACK

Name: 1014329

Hyperlink:http://securitytracker.com/id?1014329

External Source: SECUNIA

Name: 15891

Hyperlink:http://secunia.com/advisories/15891

External Source: BUGTRAQ

Name: 20050629 SEC-CONSULT SA-20050629-0

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=112006764714946&w=2

US Government Resource: oval:org.mitre.oval:def:793

Name: oval:org.mitre.oval:def:793

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:793

US Government Resource: oval:org.mitre.oval:def:1518

Name: oval:org.mitre.oval:def:1518

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1518

US Government Resource: oval:org.mitre.oval:def:1506

Name: oval:org.mitre.oval:def:1506

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1506

US Government Resource: oval:org.mitre.oval:def:1326

Name: oval:org.mitre.oval:def:1326

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1326