CVE-2004-0985
published 2004-12-31CVE-2004-0985: Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file type such as…
PriorityP339critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
20.24%
97.2th percentile
Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file type such as .xml, .doc, .py, .cdf, .css, .pdf, or .ppt, and using ADODB.Connection and ADODB.recordset to write to a .hta file that is interpreted in the Local Zone by HTML Help.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w73v-gw8h-8683: Internet Explorer 6
ghsa_unreviewed·2022-04-29
CVE-2004-0985 [HIGH] GHSA-w73v-gw8h-8683: Internet Explorer 6
Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file type such as .xml, .doc, .py, .cdf, .css, .pdf, or .ppt, and using ADODB.Connection and ADODB.recordset to write to a .hta file that is interpreted in the Local Zone by HTML Help.
Red Hat
security flaw
vendor_redhat·2004-02-18·CVSS 7.2
CVE-2004-0077 [HIGH] security flaw
security flaw
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
Red Hat
security flaw
vendor_redhat·2004-01-05·CVSS 7.2
CVE-2003-0985 [HIGH] security flaw
security flaw
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
No detection rules found.
Exploit-DB
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
exploitdb·2004-02-18·CVSS 7.2
CVE-2004-0077 [HIGH] Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
---
/*
* Proof-of-concept exploit code for do_mremap() #2
*
* EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "do_mremap() #1".
* EDB Note: This will just "test" the vulnerability. A exploit version can be found here ~ https://www.exploit-db.com/exploits/160/
*
*
* Copyright (C) 2004 Christophe Devine
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied
Exploit-DB
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Privilege Escalation
exploitdb·2004-01-15
CVE-2003-0985 Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Privilege Escalation
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Privilege Escalation
---
/*
* Linux kernel mremap() bound checking bug exploit.
*
* Bug found by Paul Starzetz
*
* Copyright (c) 2004 iSEC Security Research. All Rights Reserved.
*
* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define MREMAP_MAYMOVE 1
#define MREMAP_FIXED 2
#define str(s) #s
#define xstr(s) str(s)
#define DSIGNAL SIGCHLD
#define CLONEFL (DSIGNAL|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_VFORK)
#define PAGEADDR 0x2000
#define
Exploit-DB
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (2)
exploitdb·2004-01-07
CVE-2003-0985 Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (2)
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (2)
---
/*
* EDB Note: This will just "test" the vulnerability.
* EDB Note: An exploit version can be found here ~ https://www.exploit-db.com/exploits/145/
*/
/*
* Proof of concept code for testing do_mremap() Linux kernel bug.
* It is based on the code by Christophe Devine and Julien Tinnes
* posted on Bugtraq mailing list on 5 Jan 2004 but it's safer since
* it avoids any kernel data corruption.
*
* The following test was done against the Linux kernel 2.6.0. Similar
* results were obtained against the kernel 2.4.23 and previous ones.
*
* buffer@mintaka:~$ gcc -o mremap_bug mremap_bug.c
* buffer@mintaka:~$ ./mremap_bug
*
* Base address : 0x60000000
*
* 08048000-08049000 r-xp 00000000 03:03 2694 /home/buffer/mremap_bug
*
Exploit-DB
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1)
exploitdb·2004-01-06
CVE-2003-0985 Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1)
Linux Kernel 2.4.23/2.6.0 - 'do_mremap()' Bound Checking Validator (1)
---
/*
* EDB Note: This will just "test" the vulnerability.
* EDB Note: An exploit version can be found here ~ https://www.exploit-db.com/exploits/145/
*/
/*
* Proof-of-concept exploit code for do_mremap()
*
* Copyright (C) 2004 Christophe Devine and Julien Tinnes
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General P
Bugzilla
CVE-2003-0985 security flaw
bugzilla·2018-08-16·CVSS 7.2
CVE-2003-0985 [HIGH] CVE-2003-0985 security flaw
CVE-2003-0985 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
Bugzilla
CVE-2004-0077 security flaw
bugzilla·2018-08-16·CVSS 7.2
CVE-2004-0077 [HIGH] CVE-2004-0077 security flaw
CVE-2004-0077 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
http://marc.info/?l=bugtraq&m=109829111200055&w=2http://marc.info/?l=bugtraq&m=109830296130857&w=2http://marc.info/?l=ntbugtraq&m=109828076802478&w=2https://exchange.xforce.ibmcloud.com/vulnerabilities/17824http://marc.info/?l=bugtraq&m=109829111200055&w=2http://marc.info/?l=bugtraq&m=109830296130857&w=2http://marc.info/?l=ntbugtraq&m=109828076802478&w=2https://exchange.xforce.ibmcloud.com/vulnerabilities/17824
2004-12-31
Published