National Cyber-Alert System

Vulnerability Summary for CVE-2006-3357

Overview

Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-220A

Name: TA06-220A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-220A.html

US-CERT Vulnerability Note: VU#159220

Name: VU#159220

Hyperlink:http://www.kb.cert.org/vuls/id/159220

External Source: BID

Name: 18769

Hyperlink:http://www.securityfocus.com/bid/18769

External Source: OSVDB

Name: 26835

Hyperlink:http://www.osvdb.org/26835

External Source: VUPEN

Name: ADV-2006-2635

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2006/2635

External Source: VUPEN

Name: ADV-2006-2634

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2006/2634

External Source: SECUNIA

Name: 20906

Type: Advisory

Hyperlink:http://secunia.com/advisories/20906

External Source: MISC

Name: http://browserfun.blogspot.com/2006/07/mobb-2-internethhctrl-image-property.html

Hyperlink:http://browserfun.blogspot.com/2006/07/mobb-2-internethhctrl-image-property.html

External Source: XF

Name: ie-hhctrl-bo(27573)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27573

External Source: MISC

Name: http://www.tippingpoint.com/security/advisories/TSRT-06-08.html

Hyperlink:http://www.tippingpoint.com/security/advisories/TSRT-06-08.html

External Source: BUGTRAQ

Name: 20060808 TSRT-06-08: Microsoft Internet Help COM Object Memory Corruption Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/442733/100/0/threaded

External Source: MS

Name: MS06-046

Hyperlink:http://www.microsoft.com/technet/security/Bulletin/MS06-046.mspx

External Source: SECTRACK

Name: 1016434

Hyperlink:http://securitytracker.com/id?1016434

US Government Resource: oval:org.mitre.oval:def:13

Name: oval:org.mitre.oval:def:13

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13