COM object flaw in Internet Explorer 6

Posted by Robert Vamosi Post a comment

Share
- Digg
- Del.icio.us
- Reddit
- Facebook
Email
Print

A flaw in certain ActiveX controls in Microsoft Internet Explorer 6.0 and possibly other versions allows remote attackers to cause a denial of service and possibly execute arbitrary code. By instantiating certain COM objects, including (1) imskdic.dll (Microsoft IME), (2) chtskdic.dll (Microsoft IME), and (3) msoe.dll (Outlook), as ActiveX controls, a memory corruption occurs, crashing the Internet browser.

Additional Resources:

XSec Advisory: Internet Explorer (CHTSKDIC.DLL) COM Object
XSec Advisory: Internet Explorer (IMSKDIC.DLL) COM Object
XSec Advisory: Internet Explorer (msoe.dll) COM Object

Topics:: Browsers and extensions

Tags:: Internet Explorer

Bookmark:: Digg; Del.icio.us; Reddit

Recent posts from Zero Days: Microsoft fixes nineteen flaws in seven patches; all are considered critical updates; Storm Worm strikes again; Windows dynamic DNS update mechanism; Windows Web Proxy Autodiscovery flaw; Windows animated cursor attack

TalkBack
No discussions exist yet.

Click here to be the first to post a comment on this blog

Article discussion: COM object flaw in Internet Explorer 6

Post a comment

About Zero Days

Zero Days are security threats released before or concurrent with the public disclosure of software vulnerabilities. Our new blog will keep you ahead of the criminal hackers by informing you what you are up against.