cbcvebase.
CVE-2006-3730
published 2006-07-21

CVE-2006-3730: Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via…

PriorityP276high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
63.82%
99.1th percentile
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy.

Affected

2 ranges
VendorProductVersion rangeFixed in
microsoftie
microsoftinternet_explorer

Detection & IOCsextracted from sources · hover to see the quote

other0x7fffffff argument to setSlice method on WebViewFolderIcon ActiveX object
otherReturn address: 0x0c0c0c0c (heap spray target, Windows XP SP0-SP2 / IE 6.0SP1 English)
otherHeap spray target address: 0x05050505
otherHeap spray NOP sled pattern: %u0505%u0505
otherHeap block size: 0x400000
bytes
%u9090%u9090 (NOP sled heap spray prefix)
bytes
%u9090%u9090 NOP sled + shellcode heap spray
  • Detect invocation of the WebViewFolderIcon ActiveX setSlice() method with the argument 0x7fffffff in HTML/script content served to Internet Explorer 6.
  • Detect the shellcode byte sequence starting with EB 54 8B 75 3C in memory or network payloads — present in multiple independent exploit PoCs for this CVE.
  • Detect use of the Metasploit return address 0x0c0c0c0c (%u0c0c) in unescape() heap spray buffers targeting Windows XP SP0-SP2 / IE 6.0SP1.
  • Flag HTML files referencing the WebViewFolderIcon ActiveX CLSID combined with a setSlice() call — the exploit requires instantiation of this specific ActiveX object.
  • ·The Metasploit module randomizes all JavaScript variable names on each request, so static variable-name signatures will not reliably detect this exploit when delivered via Metasploit.
  • ·The Metasploit module also randomizes whitespace in the HTML document, further evading static content signatures.
  • ·The exploit targets only Windows XP SP0-SP2 with IE 6.0 SP1 English; the hardcoded return address 0x0c0c0c0c is specific to this platform/locale combination and will not work on other targets.
  • ·Payload bad characters are restricted to null bytes only (\x00), meaning most shellcode encodings are viable and the payload byte pattern will vary across sessions.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.