cvelistv5 - cve-2006-5578

CVE-2006-5578 (GCVE-0-2006-5578)

Vulnerability from cvelistv5

Published

2006-12-12 20:00

Modified

2024-08-07 19:55

Severity ?

CWE

Summary

Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5577.

References

URL

Tags

	http://www.vupen.com/english/advisories/2006/4966	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/23288	third-party-advisory, x_refsource_SECUNIA
	http://www.kb.cert.org/vuls/id/694344	third-party-advisory, x_refsource_CERT-VN
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A337	vdb-entry, signature, x_refsource_OVAL
	http://www.us-cert.gov/cas/techalerts/TA06-346A.html	third-party-advisory, x_refsource_CERT
	http://securitytracker.com/id?1017374	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/21494	vdb-entry, x_refsource_BID
	http://www.securityfocus.com/archive/1/454969/100/200/threaded	vendor-advisory, x_refsource_HP
	http://www.securityfocus.com/archive/1/454969/100/200/threaded	vendor-advisory, x_refsource_HP
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-072	vendor-advisory, x_refsource_MS
	http://www.osvdb.org/30815	vdb-entry, x_refsource_OSVDB

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:55:53.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2006-4966",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4966"
          },
          {
            "name": "23288",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23288"
          },
          {
            "name": "VU#694344",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/694344"
          },
          {
            "name": "oval:org.mitre.oval:def:337",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A337"
          },
          {
            "name": "TA06-346A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-346A.html"
          },
          {
            "name": "1017374",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017374"
          },
          {
            "name": "21494",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21494"
          },
          {
            "name": "SSRT061288",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded"
          },
          {
            "name": "HPSBST02180",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded"
          },
          {
            "name": "MS06-072",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-072"
          },
          {
            "name": "30815",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/30815"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-12-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka \"TIF Folder Information Disclosure Vulnerability,\" and a different issue than CVE-2006-5577."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "ADV-2006-4966",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/4966"
        },
        {
          "name": "23288",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23288"
        },
        {
          "name": "VU#694344",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/694344"
        },
        {
          "name": "oval:org.mitre.oval:def:337",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A337"
        },
        {
          "name": "TA06-346A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA06-346A.html"
        },
        {
          "name": "1017374",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017374"
        },
        {
          "name": "21494",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21494"
        },
        {
          "name": "SSRT061288",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded"
        },
        {
          "name": "HPSBST02180",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded"
        },
        {
          "name": "MS06-072",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-072"
        },
        {
          "name": "30815",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/30815"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2006-5578",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka \"TIF Folder Information Disclosure Vulnerability,\" and a different issue than CVE-2006-5577."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2006-4966",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/4966"
            },
            {
              "name": "23288",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23288"
            },
            {
              "name": "VU#694344",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/694344"
            },
            {
              "name": "oval:org.mitre.oval:def:337",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A337"
            },
            {
              "name": "TA06-346A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA06-346A.html"
            },
            {
              "name": "1017374",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017374"
            },
            {
              "name": "21494",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21494"
            },
            {
              "name": "SSRT061288",
              "refsource": "HP",
              "url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded"
            },
            {
              "name": "HPSBST02180",
              "refsource": "HP",
              "url": "http://www.securityfocus.com/archive/1/454969/100/200/threaded"
            },
            {
              "name": "MS06-072",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-072"
            },
            {
              "name": "30815",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/30815"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2006-5578",
    "datePublished": "2006-12-12T20:00:00.000Z",
    "dateReserved": "2006-10-27T00:00:00.000Z",
    "dateUpdated": "2024-08-07T19:55:53.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2006-AVI-545

Vulnerability from certfr_avis

De multiples vulnérabilités présentes dans Microsoft Internet Explorer permettent l'exécution de code arbitraire à distance ou le contournement de la politique de sécurité.

Description

La première vulnérabilité exploite une mauvaise gestion de la libération de la mémoire dans certaines situations. Une personne malintentionnée peut utiliser cette vulnérabilité afin d'exécuter du code arbitraire à distance par le biais d'une page Web spécialement conçue.

La seconde vulnérabilité réside dans une mauvaise gestion des appels des fonctions des scripts au format DHTML. Un utilisateur malveillant peut exploiter cette vulnérabilité afin d'exécuter du code arbitraire à distance par le biais d'une page Web spécialement conçue.

La troisième vulnérabilité consiste en une mauvaise gestion des opérations Glisser-Déplacer (Drag and Drop) dans certaines conditions. Un utilisateur malveillant exploitant cette vulnérabilité pourrait accéder à certains fichiers présents sur l'ordinateur de sa victime.

La quatrième vulnérabilité permet de divulguer le contenu mis en cache dans le dossier Temporay Internet Files. Une personne malveillante exploitant cette vulnérabilité pourrait accéder à certains fichiers présents sur l'ordinateur de sa victime par le biais d'une page Web spécialement conçue. L'exploitation de cette vulnérabilité nécessite une action de l'utilisateur.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Microsoft	N/A	Microsoft Internet Explorer 5.01 ;
	Microsoft	N/A	Microsoft Internet Explorer 6.

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS06-072 du 12 décembre 2006

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Internet Explorer 5.01 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Internet Explorer 6.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLa premi\u00e8re vuln\u00e9rabilit\u00e9 exploite une mauvaise gestion de la lib\u00e9ration\nde la m\u00e9moire dans certaines situations. Une personne malintentionn\u00e9e\npeut utiliser cette vuln\u00e9rabilit\u00e9 afin d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance par le biais d\u0027une page Web sp\u00e9cialement con\u00e7ue.\n\nLa seconde vuln\u00e9rabilit\u00e9 r\u00e9side dans une mauvaise gestion des appels des\nfonctions des scripts au format DHTML. Un utilisateur malveillant peut\nexploiter cette vuln\u00e9rabilit\u00e9 afin d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance par le biais d\u0027une page Web sp\u00e9cialement con\u00e7ue.\n\nLa troisi\u00e8me vuln\u00e9rabilit\u00e9 consiste en une mauvaise gestion des\nop\u00e9rations Glisser-D\u00e9placer (Drag and Drop) dans certaines conditions.\nUn utilisateur malveillant exploitant cette vuln\u00e9rabilit\u00e9 pourrait\nacc\u00e9der \u00e0 certains fichiers pr\u00e9sents sur l\u0027ordinateur de sa victime.\n\nLa quatri\u00e8me vuln\u00e9rabilit\u00e9 permet de divulguer le contenu mis en cache\ndans le dossier Temporay Internet Files. Une personne malveillante\nexploitant cette vuln\u00e9rabilit\u00e9 pourrait acc\u00e9der \u00e0 certains fichiers\npr\u00e9sents sur l\u0027ordinateur de sa victime par le biais d\u0027une page Web\nsp\u00e9cialement con\u00e7ue. L\u0027exploitation de cette vuln\u00e9rabilit\u00e9 n\u00e9cessite une\naction de l\u0027utilisateur.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-5577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5577"
    },
    {
      "name": "CVE-2006-5579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5579"
    },
    {
      "name": "CVE-2006-5581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5581"
    },
    {
      "name": "CVE-2006-5578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5578"
    }
  ],
  "initial_release_date": "2006-12-13T00:00:00",
  "last_revision_date": "2006-12-13T00:00:00",
  "links": [],
  "reference": "CERTA-2006-AVI-545",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans Microsoft Internet Explorer\npermettent l\u0027ex\u00e9cution de code arbitraire \u00e0 distance ou le contournement\nde la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Internet Explorer",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-072 du 12 d\u00e9cembre 2006",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-072.mspx"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2006-5578 (GCVE-0-2006-5578)

Vulnerability from cvelistv5

CERTA-2006-AVI-545

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature