cbcvebase.
CVE-2006-1359
published 2006-03-23

CVE-2006-1359: Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain…

PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
68.07%
99.2th percentile
Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.

Affected

3 ranges
VendorProductVersion rangeFixed in
microsoftie
microsoftie
microsoftinternet_explorer

Detection & IOCsextracted from sources · hover to see the quote

commandcreateTextRange()
other0x746F9468
other0x3C0474C2
other0x3c0974c2
bytes
%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55
  • The exploit triggers via a createTextRange() call on a checkbox, radio, or image input element — look for JavaScript creating an input element of type checkbox/radio/image followed by a createTextRange() invocation in browser traffic.
  • Exploit uses heap spray: large arrays of NOP sleds (%u9090%u9090) followed by shellcode are allocated via JavaScript unescape() loops. Monitor for repeated unescape() calls building multi-megabyte heap blocks (heapBlockSize = 0x400000).
  • Metasploit module randomizes JavaScript variable names (prefixed with '_') and may randomize whitespace; detection should focus on the createTextRange() call pattern on form input elements rather than static variable names.
  • The exploit HTML page may use gzip Content-Encoding and/or chunked Transfer-Encoding to evade content inspection — ensure IDS/proxy decodes both before scanning.
  • Return address 0x746F9468 targets IE6 (6.0.3790.0) on Windows XP SP2; 0x3C0474C2 / 0x3c0974c2 targets IE7 Beta (7.0.5229.0) on Windows XP SP2. Presence of these DWORD values in network payloads is a strong indicator.
  • Exploit delivery uses a setTimeout or setInterval call (interval of 5 ms) to trigger the heap fill function — this pattern in conjunction with unescape() heap spray is characteristic of this exploit.
  • ·The Metasploit module has only been reliably tested against Windows XP SP2; reliability on other platforms is not confirmed.
  • ·JavaScript variable names used in the exploit HTML are randomized per request, making static string-based signatures unreliable without behavioral analysis.
  • ·The return address differs between the two known exploit variants for IE7 (0x3C0474C2 vs 0x3c0974c2), suggesting multiple independent exploit implementations with slightly different offsets.

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.