CVE-2004-0978: Buffer Overflow

Published Oct 21, 2004

Updated

Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6, when users who visit online gaming sites that are associated with MSN, allows remote attackers to execute arbitrary code via the SetupData parameter.

Affected Software

17 affected components

Microsoft Internet Explorer=5.01-sp3

Microsoft Internet Explorer=5.01-sp4

Microsoft Windows 2000=sp3

Microsoft Windows 2000=sp4

Microsoft Internet Explorer=5.5-sp2

Microsoft Windows Me

Microsoft Internet Explorer=6

Microsoft Windows Server 2003

Microsoft Windows XP

Microsoft Windows XP=sp1

Microsoft Windows XP=sp2

Microsoft Internet Explorer=6-sp1

Microsoft Windows 98SE

Microsoft Windows NT=4.0-sp6

Microsoft Windows NT=4.0-sp6a

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038

Event History

Oct 21, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Feb 9, 2005

Data Sourced

05:00 AM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2004-0978?

CVE-2004-0978 is considered critical due to the potential for remote code execution.

How do I fix CVE-2004-0978?

To fix CVE-2004-0978, users should apply any available security patches released by Microsoft for affected versions of Internet Explorer.

What versions of Internet Explorer are affected by CVE-2004-0978?

CVE-2004-0978 affects Internet Explorer versions 5.01 through 6, specifically SP2.

Can I mitigate CVE-2004-0978 without updates?

Mitigation of CVE-2004-0978 without updates can be done by avoiding online gaming sites using the Heartbeat ActiveX control.

What is the nature of the vulnerability in CVE-2004-0978?

CVE-2004-0978 is a heap-based buffer overflow vulnerability in the Heartbeat ActiveX control.