Description
Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Internet Explorer (Windows XP SP2) - HTML Help Control Local Zone Bypass EDB-719 · remote · Dec 25, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:1349 vdb-entry signature
- oval:org.mitre.oval:def:1963 vdb-entry signature
- VU#972415 third-party-advisory
- ie-helpactivexcontrol-save-file(18311) vdb-entry
- 20041225 Microsoft Internet Explorer SP2 Fully Automated Remote Compromise mailing-list
- oval:org.mitre.oval:def:2830 vdb-entry signature
- MS05-001 vendor-advisory
- TA05-012B third-party-advisory
- oval:org.mitre.oval:def:3496 vdb-entry signature