CVE-2005-2087
published 2005-07-05CVE-2005-2087: Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of…
PriorityP266medium5CVSS 2.0
AVNACLAuNCNINAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
61.37%
99.1th percentile
Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
| microsoft | ie | — | — |
| microsoft | ie | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0
bytes↗
%u0D0D%u0D0D
- →Detect instantiation of the javaprxy.dll COM object via CLSID 03D9F3F2-B0E3-11D2-B081-006008039BF0 in Internet Explorer — this is the vulnerable object exploited by CVE-2005-2087. ↗
- →Hunt for heap-spray NOP sled pattern %u0D0D%u0D0D (0x0D0D0D0D) in JavaScript within HTML pages, characteristic of this exploit's heap spray technique. ↗
- →Alert on outbound TCP connections to port 28876 from iexplore.exe processes, indicative of a successful bindshell payload execution from this exploit. ↗
- →Detect use of unescape() with shellcode beginning with %u4343%u4343 in JavaScript — this is the specific shellcode stub used in the javaprxy.dll exploit. ↗
- →Monitor for HTML pages embedding the CLSID 03D9F3F2-B0E3-11D2-B081-006008039BF0 in OBJECT or similar tags, as this directly triggers the vulnerable COM object instantiation. ↗
- ·The exploit targets Internet Explorer 5.01 SP3/SP4, 5.5 SP2, and 6 SP1/RTM across Windows 98/ME/2000/XP/2003; detection should be scoped to these legacy platform/browser combinations. ↗
- ·The workaround of setting Internet and Local intranet security zones to 'High' blocks COM object instantiation and prevents exploitation without a patch. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vulncheck5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rfj5-j343-wwwp: Internet Explorer 5
ghsa_unreviewed·2022-05-01
CVE-2005-2087 [MEDIUM] GHSA-rfj5-j343-wwwp: Internet Explorer 5
Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
GHSA
GHSA-pgqj-26qf-9f3x: Internet Explorer 5
ghsa_unreviewed·2022-05-01·CVSS 5.0
CVE-2005-1990 [MEDIUM] GHSA-pgqj-26qf-9f3x: Internet Explorer 5
Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.
VulnCheck
Microsoft IE 5.01 SP4 up to 6 javaprxy.dll COM Instantiation Heap Corruption Vulnerability
vulncheck·2005·CVSS 5.0
CVE-2005-2087 [MEDIUM] Microsoft IE 5.01 SP4 up to 6 javaprxy.dll COM Instantiation Heap Corruption Vulnerability
Microsoft IE 5.01 SP4 up to 6 javaprxy.dll COM Instantiation Heap Corruption Vulnerability
Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
Affected: Microsoft Internet Explorer
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com
No detection rules found.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=112006764714946&w=2http://secunia.com/advisories/15891http://securitytracker.com/id?1014329http://www.auscert.org.au/render.html?it=5225http://www.kb.cert.org/vuls/id/939605http://www.kb.cert.org/vuls/id/959049http://www.microsoft.com/technet/security/advisory/903144.mspxhttp://www.osvdb.org/17680http://www.securityfocus.com/archive/1/404055http://www.securityfocus.com/bid/14087http://www.us-cert.gov/cas/techalerts/TA05-193A.htmlhttp://www.vupen.com/english/advisories/2005/0935https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-037https://exchange.xforce.ibmcloud.com/vulnerabilities/21193https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1326https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1506https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1518https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A793http://marc.info/?l=bugtraq&m=112006764714946&w=2http://secunia.com/advisories/15891http://securitytracker.com/id?1014329http://www.auscert.org.au/render.html?it=5225http://www.kb.cert.org/vuls/id/939605http://www.kb.cert.org/vuls/id/959049http://www.microsoft.com/technet/security/advisory/903144.mspxhttp://www.osvdb.org/17680http://www.securityfocus.com/archive/1/404055http://www.securityfocus.com/bid/14087http://www.us-cert.gov/cas/techalerts/TA05-193A.htmlhttp://www.vupen.com/english/advisories/2005/0935https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-037https://exchange.xforce.ibmcloud.com/vulnerabilities/21193https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1326https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1506https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1518https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A793
2005-07-05
Published
Exploited in the wild