Advisory ID: XSec-06-10 Advisory Name: Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability Release Date: 08/28/2006 Tested on: Windows 2000/XP/2003 Internet Explorer 6.0 SP1 Affected version: Windows 2000 Windows XP Windows 2003 Author: nop http://www.xsec.org Overview: When Internet Explorer handle DirectAnimation.PathControl COM object(daxctle.ocx) \ Spline method, Set the first parameter to 0xffffffff will triggers an invalid memory \ write, That an attacker may DoS and possibly could execute arbitrary code. Exploit: =============== daxctle.htm start ================ test =============== daxctle.htm end ================== Link: http://www.xsec.org/index.php?module=releases&act=view&type=1&id=19 About XSec: We are redhat.