CVE-2005-2127: Buffer Overflow
First published: Fri Aug 19 2005(Updated: )
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft .NET Framework 4 | =1.1-sp1 | |
| Microsoft Visual Studio | =2003-gold | |
| Microsoft Visio Standard | =2002-sp1 | |
| Microsoft .NET Framework 4 | =1.1-sp2 | |
| Microsoft Project 2013 | =2002-sp1 | |
| Microsoft Project 2013 | =2003 | |
| Microsoft Visio Standard | =2002 | |
| Microsoft Office | =xp-sp3 | |
| Microsoft Project 2013 | =2000 | |
| Microsoft Visio Standard | =2003-sp1 | |
| Microsoft Office | =2000 | |
| AMD Catalyst Driver | ||
| Microsoft Office | ||
| Microsoft Project 2013 | =2002 | |
| Microsoft Office | =xp-sp2 | |
| Microsoft .NET Framework 4 | =1.1 | |
| Microsoft Visio Standard | =2002-sp2 | |
| Microsoft .NET Framework 4 | =1.1-sp3 | |
| Microsoft Project 2013 | =98 | |
| Microsoft Office | =2000-sp1 | |
| Microsoft Project 2013 | =2003-sp1 | |
| Microsoft Office | =2000-sp2 | |
| Microsoft Visio Standard | =2003 | |
| Microsoft Visual Studio | =2002-gold | |
| Microsoft Office | =xp-sp1 | |
| Microsoft Office | =2000-sp3 | |
| Microsoft Office | =2000 | |
| Microsoft Office | =2000 | |
| Microsoft Office | =2000 | |
| Microsoft Visio Standard | =2000-sr1 | |
| Microsoft Visio Standard | =2002 | |
| Microsoft Visio Standard | =2002-sp2 | |
| Microsoft Visio Standard | =2002-sp2 | |
| Microsoft Visio Standard | =2003 | |
| Microsoft Visio Standard | =2003 | |
| Microsoft Visual Studio | =2003 | |
| Microsoft Visual Studio | =gold | |
| Microsoft Visual Studio | =gold | |
| Microsoft Visual Studio | =gold | |
| Microsoft Visual Studio | =gold | |
| Microsoft Visual Studio | =gold |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.microsoft.com/technet/security/advisory/906267.mspx
- http://www.securityfocus.com/bid/14594
- http://securitytracker.com/id?1014727
- http://secunia.com/advisories/16480
- http://www.kb.cert.org/vuls/id/740372
- http://isc.sans.org/diary.php?date=2005-08-18
- http://www.us-cert.gov/cas/techalerts/TA05-284A.html
- http://www.kb.cert.org/vuls/id/959049
- http://www.kb.cert.org/vuls/id/898241
- http://www.us-cert.gov/cas/techalerts/TA05-347A.html
- http://www.securityfocus.com/bid/15061
- http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
- http://secunia.com/advisories/17172
- http://secunia.com/advisories/17223
- http://secunia.com/advisories/17509
- http://www.us-cert.gov/cas/techalerts/TA06-220A.html
- http://securityreason.com/securityalert/72
- http://www.vupen.com/english/advisories/2005/1450
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34754
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21895
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1538
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1535
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1468
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1464
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1454
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1155
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-052
- http://www.securityfocus.com/archive/1/470690/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-2127?
The severity of CVE-2005-2127 is categorized as high due to its potential for causing denial of service and executing arbitrary code.
How do I fix CVE-2005-2127?
To fix CVE-2005-2127, ensure that you install the latest security patches from Microsoft for affected Internet Explorer versions.
Which versions of Internet Explorer are affected by CVE-2005-2127?
CVE-2005-2127 affects Microsoft Internet Explorer versions 5.01, 5.5, and 6.
What exploitation methods are associated with CVE-2005-2127?
CVE-2005-2127 can be exploited through a web page containing embedded CLSIDs that reference specific COM objects not intended for Internet Explorer.
Can CVE-2005-2127 lead to data breaches?
Yes, CVE-2005-2127 has the potential to lead to data breaches as it may allow attackers to execute arbitrary code remotely.
- agent/references
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/microsoft
- canonical/microsoft .net framework 4
- version/microsoft .net framework 4/1.1-sp1
- canonical/microsoft visual studio
- version/microsoft visual studio/2003-gold
- canonical/microsoft visio standard
- version/microsoft visio standard/2002-sp1
- version/microsoft .net framework 4/1.1-sp2
- canonical/microsoft project 2013
- version/microsoft project 2013/2002-sp1
- version/microsoft project 2013/2003
- version/microsoft visio standard/2002
- canonical/microsoft office
- version/microsoft office/xp-sp3
- version/microsoft project 2013/2000
- version/microsoft visio standard/2003-sp1
- version/microsoft office/2000
- vendor/ati
- canonical/amd catalyst driver
- version/microsoft project 2013/2002
- version/microsoft office/xp-sp2
- version/microsoft .net framework 4/1.1
- version/microsoft visio standard/2002-sp2
- version/microsoft .net framework 4/1.1-sp3
- version/microsoft project 2013/98
- version/microsoft office/2000-sp1
- version/microsoft project 2013/2003-sp1
- version/microsoft office/2000-sp2
- version/microsoft visio standard/2003
- version/microsoft visual studio/2002-gold
- version/microsoft office/xp-sp1
- version/microsoft office/2000-sp3
- version/microsoft visio standard/2000-sr1
- version/microsoft visual studio/2003
- version/microsoft visual studio/gold