IE6 / msdds.dll exploit

Hugh Jarss · 2005/08/19

Hi all

re: IE6 vulnerability if you have msdds.dll on your computer;

typically msdds.dll may come with VisualStudio6 or Microsoft Office 2000, 2002, XP; other software too; see the link below for a list

if you can FileFind msdds.dll on your machine, you may want to take a look at SANS for details and a workaround

best wishes, HJ

mailman · 2005/08/21

Hi, "Hugh ".

I composed this info before discovering your post. Adding it here.

Microsoft Security Advisory (906267)
A COM Object (Msdds.dll) Could Cause Internet Explorer to Unexpectedly Exit
Published: August 18, 2005 | Updated: August 19, 2005
www.microsoft.com/technet/security/advisory/906267.mspx

Excerpt:

"Microsoft is investigating new public reports of a possible vulnerability in Internet Explorer. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time. Microsoft is aggressively investigating the public reports.

The Microsoft DDS Library Shape Control (Msdds.dll) is a COM object that could, when called from a Web page displayed in Internet Explorer, cause Internet Explorer to unexpectedly exit. This condition could potentially allow remote code execution if a user visited a malicious Web site. This COM Object is not marked safe for scripting and is not intended for use in Internet Explorer...

...Customers who do not have Msdds.dll on their systems are not affected by this vulnerability.
The affected versions of Msdds.dll are 7.0.9064.9112 and 7.0.9446.0. Customers who have Msdds.dll with version 7.0.9955.0, 7.10.3077.0, or higher on their systems are not affected by this vulnerability. "
Click to expand...

Additional References:
http://secunia.com/advisories/16480/
http://www.kb.cert.org/vuls/id/740372

Log in or Sign up

IE6 / msdds.dll exploit

Hugh Jarss Inactive Thread Starter

mailman Geek Member

Share This Page

Log in or Sign up

IE6 / msdds.dll exploit

Hugh Jarss Inactive Thread Starter

mailman Geek Member

Share This Page

Useful Searches