1. CVE-Search
  2. CVE-2005-2087
ID CVE-2005-2087
Summary Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:6.0.2900.2180:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:6.0.2900.2180:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:ie:5.2.3:*:macintosh:*:*:*:*:*
    cpe:2.3:a:microsoft:ie:5.2.3:*:macintosh:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:5.1:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:ie:5.1:*:mac_os:*:*:*:*:*
    cpe:2.3:a:microsoft:ie:5.1:*:mac_os:*:*:*:*:*
  • cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:5.5:preview:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.5:preview:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 23-07-2021 - 15:04)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
oval via4
  • accepted 2014-02-24T04:00:14.351-05:00
    class vulnerability
    contributors
    • name Harvey Rubinovitz
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Maria Mikhno
      organization ALTX-SOFT
    description Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
    family windows
    id oval:org.mitre.oval:def:1326
    status accepted
    submitted 2005-08-18T04:00:00.000-04:00
    title IE5.01,SP4 Java Proxy COM Object Instantiation Memory Corruption Vulnerability
    version 68
  • accepted 2014-02-24T04:00:18.533-05:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Maria Mikhno
      organization ALTX-SOFT
    description Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
    family windows
    id oval:org.mitre.oval:def:1506
    status accepted
    submitted 2005-12-26T09:36:00.000-04:00
    title IE6,SP1 Java Proxy COM Object Instantiation Memory Corruption Vulnerability
    version 67
  • accepted 2014-02-24T04:00:19.108-05:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Sudhir Gandhe
      organization Telos
    • name Shane Shaffer
      organization G2, Inc.
    • name Maria Mikhno
      organization ALTX-SOFT
    description Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
    family windows
    id oval:org.mitre.oval:def:1518
    status accepted
    submitted 2005-12-26T09:36:00.000-04:00
    title IE6:S03 Java Proxy COM Object Instantiation Memory Corruption Vulnerability
    version 71
  • accepted 2014-02-24T04:03:27.734-05:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Maria Mikhno
      organization ALTX-SOFT
    description Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem.
    family windows
    id oval:org.mitre.oval:def:793
    status accepted
    submitted 2005-12-26T09:36:00.000-04:00
    title IE6:XP,SP2 Java Proxy COM Object Instantiation Memory Corruption Vulnerability
    version 66
refmap via4
auscert ESB-2005.0489
bid 14087
bugtraq
  • 20050629 SEC-CONSULT SA-20050629-0
  • 20050702 Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit
cert TA05-193A
cert-vn
  • VU#939605
  • VU#959049
misc http://www.microsoft.com/technet/security/advisory/903144.mspx
osvdb 17680
sectrack 1014329
secunia 15891
vupen ADV-2005-0935
xf ie-javaprxydll-execute-code(21193)
saint via4
bid 14087
description Internet Explorer Javaprxy.dll heap overflow
id win_patch_ie_javaprxy
osvdb 17680
title ie_javaprxy
type client
Last major update 23-07-2021 - 15:04
Published 05-07-2005 - 04:00
Last modified 23-07-2021 - 15:04
Back to Top