Drew Copley

The issue allows remote attackers to create files with arbitrary content. This is demonstrated by creating a .hta file in a Startup folder, utilizing the SetDebugging and RunEgatherer methods in the IBM Access Support eGatherer ActiveX control.

The issue allows remote attackers to bypass zone restrictions and inject arbitrary programs by creating a popup window and inserting ActiveX object code. This code is treated as HTML or Javascript initially but is later executed as an HTA application. The QHosts Trojan horse has been used to exploit this issue.

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 SP3 through 6.0 SP1 Description: The issue arises from improper determination of object types returned by web servers, potentially allowing remote attackers to execute arbitrary code. This can be achieved via an object tag with a `data` parameter to a malicious file hosted on a server that returns an unsafe Content-Type. Recommendations: For versions 5.01 SP3 through 6.0 SP1, consider disabling the use of object tags with external data parameters until a fix is available. Restrict access to malicious files hosted on servers that return unsafe Content-Types to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 5.01 through 6.0 Description: A buffer overflow issue allows remote attackers to execute arbitrary code via / (slash) characters in the `Type` property of an `Object` tag in a web page. Recommendations: For Microsoft Internet Explorer versions 5.01 through 6.0, update to a newer version to mitigate the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: RealOne Player versions 6.0.11.x and earlier RealPlayer 8/RealPlayer Plus 8 version 6.0.9.584 Description: The issue concerns the PNG deflate algorithm, which allows remote attackers to corrupt the heap and overwrite arbitrary memory. This is achieved through a PNG graphic file format containing compressed data using fixed trees that contain the length values 286-287, treated as a very large length. Recommendations: For RealOne Player versions 6.0.11.x and earlier, update to a version later than 6.0.11.x to resolve the issue. For RealPlayer 8/RealPlayer Plus 8 version 6.0.9.584, update to a version later than 6.0.9.584 to resolve the issue.