CERT-In Vulnerability Note
CIVN-2006-0103
Microsoft Windows Object Packager Dialogue Spoofing Vulnerability
Original Issue Date:October 11, 2006
Severity Rating: MEDIUM
Systems Affected
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems Microsoft Windows Server 2003 x64 Edition
Overview
A remote code execution vulnerability has been reported in Microsoft Windows Object Packager which could be exploited to take complete control of the effected system.
Description
A remote code execution vulnerability has been reported in Microsoft Windows Object Packager due to an error in the Object Packager packager.exe that does not validate the "Command Line" property, this vulnerability could be exploited by a malicious user to construct a specially crafted file that could potentially allow remote code execution if a user visited a specially crafted Web site.
A malicious user who successfully exploited this vulnerability could take complete control of an affected system and could then install programs; view, change, or delete data; or create new accounts with full user rights; user interaction is required to exploit this vulnerability
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin MS06-065
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/Bulletin/MS06-065.mspx
References
Microsoft
http://www.microsoft.com/technet/security/Bulletin/MS06-065.mspx
SecurityFocus
http://www.securityfocus.com/bid/20318/info
FrSIRT
http://www.frsirt.com/english/advisories/2006/3984
Secunia
http://secunia.com/advisories/20717/
US CERT
http://www.kb.cert.org/vuls/id/703936
CVE Name
CVE-2006-4692
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|