Blog Laboratorio Hispasec

Existe un exploit para inventariar el hw de una red

Comprueba los ultimos exploits si afecta tu Internet Explorer a traves de este sitio web :http://www.livezone.es/test-internet-explorer.Encontraras los ultimos exploits para el browser internet explorer.

Microsoft Windows Msdds.dll object command execution
Win-msdds-command-execution (21895) The risk level is classified as HighHigh Risk

Description:

Microsoft Windows operating systems running the Msdds.dll library version 7.0.9064.9112 could allow a remote or local attacker to execute arbitrary code. When instantiating the Microsoft DDS Library Shape Control (Msdds.dll) object, or other COM objects, as ActiveX controls, a memory corruption error can occur. A remote attacker could exploit this vulnerability by creating a malicious Web page and hosting it on a Web site or by sending it to a victim as an HTML email. The attacker could execute arbitrary code on the system and take complete control over the victim's system or cause Internet Explorer to crash when the victim opens the Web page.

Platforms Affected:

* Microsoft Corporation: Microsoft Internet Explorer 5.01 SP4
* Microsoft Corporation: Microsoft Internet Explorer 5.5 SP2
* Microsoft Corporation: Microsoft Internet Explorer 6.0
* Microsoft Corporation: Microsoft Internet Explorer 6.0 SP1
* Microsoft Corporation: Windows 98
* Microsoft Corporation: Windows 98 Second Edition
* Microsoft Corporation: Windows Me
* Microsoft Corporation: Windows 2000 SP4
* Microsoft Corporation: Windows Server 2003
* Microsoft Corporation: Windows Server 2003 Itanium
* Microsoft Corporation: Windows Server 2003 SP1
* Microsoft Corporation: Windows Server 2003 SP1 Itanium
* Microsoft Corporation: Windows Server 2003 x64 Edition
* Microsoft Corporation: Windows XP Pro x64 Edition
* Microsoft Corporation: Windows XP SP1
* Microsoft Corporation: Windows XP SP2
* Nortel: CallPilot Any Version

Remedy:

Apply the appropriate patch for your system, as listed in Microsoft Security Advisory MS06-072. See References.

Note: Microsoft originally provided a patch for this vulnerability in MS05-052, but it has been superceded by the patch released with MS05-054, MS06-004, MS06-013, MS06-021, MS06-042, and MS06-067 which have also been superceded with the patch released with MS06-072. See References.

As a workaround, follow the procedures as listed in Microsoft Security Advisory (906267). See References.

For CallPilot:
Apply the fix as listed in Security Advisory P-2005-0056-Global, available from the Nortel Networks Web site. See References. A login account is required for access.

Consequences:

Gain Access