CVE-2006-4494: High severity Microsoft Visual Studio vulnerability

Published Aug 31, 2006

Updated

Microsoft Visual Studio 6.0 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by instantiating certain Visual Studio 6.0 ActiveX COM Objects in Internet Explorer, including (1) tcprops.dll, (2) fp30wec.dll, (3) mdt2db.dll, (4) mdt2qd.dll, and (5) vi30aut.dll.

Affected Software

2 affected components

Microsoft Visual Studio=6.0

Microsoft Visual Studio=6.0-sp1

Event History

Aug 31, 2006

CVE Published

10:04 PM

Sep 1, 2006

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4494?

CVE-2006-4494 is classified as a high severity vulnerability due to its potential to cause denial of service and arbitrary code execution.

How do I fix CVE-2006-4494?

To mitigate CVE-2006-4494, users should upgrade to a supported version of Microsoft Visual Studio or apply any relevant security patches provided by Microsoft.

What types of attacks can exploit CVE-2006-4494?

CVE-2006-4494 can be exploited through specially crafted ActiveX COM objects in Internet Explorer to lead to memory corruption.

Which versions of Microsoft Visual Studio are affected by CVE-2006-4494?

CVE-2006-4494 specifically affects Microsoft Visual Studio 6.0 and its Service Pack 1.

Can CVE-2006-4494 be exploited remotely?

Yes, CVE-2006-4494 can be exploited remotely by attackers through manipulated web pages that utilize vulnerable ActiveX controls.