1. CVE-Search
  2. CVE-2008-3475
ID CVE-2008-3475
Summary Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*
    cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*
    cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*
    cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:-:*:itanium:*
    cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:-:*:itanium:*
  • cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:-:*:*:*:professional:*:x64:*
    cpe:2.3:o:microsoft:windows_xp:-:*:*:*:professional:*:x64:*
  • cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*
    cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*
  • cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 08-02-2024 - 23:46)
Impact:
Exploitability:
CWE CWE-908
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
oval via4
accepted 2011-12-05T04:00:12.120-05:00
class vulnerability
contributors
name SecPod Team
organization SecPod Technologies
definition_extensions
  • comment Microsoft Windows 2000 SP4 or later is installed
    oval oval:org.mitre.oval:def:229
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Windows XP (x86) SP2 is installed
    oval oval:org.mitre.oval:def:754
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Windows XP (x86) SP3 is installed
    oval oval:org.mitre.oval:def:5631
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Windows XP Professional x64 Edition SP1 is installed
    oval oval:org.mitre.oval:def:720
  • comment Microsoft Windows Server 2003 SP1 (x86) is installed
    oval oval:org.mitre.oval:def:565
  • comment Microsoft Windows Server 2003 SP1 (x64) is installed
    oval oval:org.mitre.oval:def:4386
  • comment Microsoft Windows Server 2003 SP1 for Itanium is installed
    oval oval:org.mitre.oval:def:1205
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Windows Server 2003 SP2 (x86) is installed
    oval oval:org.mitre.oval:def:1935
  • comment Microsoft Windows Server 2003 SP2 (x64) is installed
    oval oval:org.mitre.oval:def:2161
  • comment Microsoft Windows Server 2003 (ia64) SP2 is installed
    oval oval:org.mitre.oval:def:1442
  • comment Microsoft Windows XP x64 Edition SP2 is installed
    oval oval:org.mitre.oval:def:4193
description Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."
family windows
id oval:org.mitre.oval:def:13151
status accepted
submitted 2011-10-25T13:27:14
title Uninitialized Memory Corruption Vulnerability in Internet Explorer
version 74
refmap via4
bid 31617
bugtraq 20081015 Internet Explorer 6 componentFromPoint() remote memory disclosure and remote code execution
cert TA08-288A
hp
  • HPSBST02379
  • SSRT080143
misc
sectrack 1021047
vupen ADV-2008-2809
xf
  • ie-uninitialized-objects-code-execution(45563)
  • win-ms08kb956390-update(45565)
Last major update 08-02-2024 - 23:46
Published 15-10-2008 - 00:12
Last modified 08-02-2024 - 23:46
Back to Top