Description
Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.
References
- oval:org.mitre.oval:def:5316 vdb-entry signature
- http://www.ngssoftware.com/advisories/msinsengfull.txt
- VU#637760 third-party-advisory
- MS04-038 vendor-advisory
- ie-installenginectl-setciffile-bo(17620) vdb-entry
- oval:org.mitre.oval:def:7865 vdb-entry signature
- TA04-293A third-party-advisory
- ie-ms04038-patch(17651) vdb-entry
- oval:org.mitre.oval:def:7717 vdb-entry signature
- oval:org.mitre.oval:def:6100 vdb-entry signature
- oval:org.mitre.oval:def:6600 vdb-entry signature
- 20050119 Microsoft Internet Explorer Install Engine Control Buffer Overflow (#NISR19012005a) mailing-list
- 20041012 Microsoft Internet Explorer Install Engine Control Buffer Overflow mailing-list
- 20050119 Microsoft Internet Explorer Install Engine Control Buffer Overflow (#NISR19012005a) mailing-list
- oval:org.mitre.oval:def:5329 vdb-entry signature