CVE-2005-2127

CVSS V2 High 7.5 CVSS V3 None
Description
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
Overview
  • CVE ID
  • CVE-2005-2127
  • Assigner
  • secure@microsoft.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2005-08-19T04:00:00
  • Last Modified Date
  • 2018-10-19T15:32:34
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:ati:catalyst_driver:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:1.1:sp2:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:1.1:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:*:*:ja:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:*:*:ko:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:*:*:zh:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:sp2:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:xp:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:xp:sp2:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:project:98:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:project:2000:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:project:2002:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:project:2003:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:project:2003:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2000:sr1:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2002:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2002:*:*:*:professional:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2002:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:professional:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:standard:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2003:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2003:*:*:*:professional:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2003:*:*:*:standard:*:*:* 1 OR
cpe:2.3:a:microsoft:visio:2003:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:2002:gold:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:2003:*:*:*:enterprise_architect:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:2003:gold:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:gold:*:*:*:academic:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:gold:*:*:*:enterprise_architect:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:gold:*:*:*:enterprise_developer:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:gold:*:*:*:professional:*:*:* 1 OR
cpe:2.3:a:microsoft:visual_studio_.net:gold:*:*:*:trial:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://www.microsoft.com/technet/security/advisory/906267.mspx Mitigation Patch Vendor Advisory
http://www.securityfocus.com/bid/14594 Exploit Patch VDB Entry Third Party Advisory
http://securitytracker.com/id?1014727 Exploit Patch Vendor Advisory Third Party Advisory VDB Entry
http://secunia.com/advisories/16480 Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/740372 Third Party Advisory US Government Resource
http://isc.sans.org/diary.php?date=2005-08-18 Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA05-284A.html Third Party Advisory US Government Resource
http://www.kb.cert.org/vuls/id/959049 Third Party Advisory US Government Resource
http://www.kb.cert.org/vuls/id/898241 Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA05-347A.html Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/15061 Third Party Advisory VDB Entry
http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf Third Party Advisory
http://secunia.com/advisories/17172 Permissions Required Third Party Advisory
http://secunia.com/advisories/17223 Permissions Required Third Party Advisory
http://secunia.com/advisories/17509 Permissions Required Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA06-220A.html Third Party Advisory US Government Resource
http://securityreason.com/securityalert/72 Third Party Advisory
http://www.vupen.com/english/advisories/2005/1450 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/34754 VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/21895 VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1538
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1535
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1468
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1464
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1454
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1155
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-052
http://www.securityfocus.com/archive/1/470690/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2005-2127
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2127
History
Created Old Value New Value Data Type Notes
2022-05-10 18:05:21 Added to TrackCVE