Exploitation Summary
EIP tracks 3 public exploits for CVE-2010-0805.
PoCs published by Metasploit, ZSploit.com, Unknown, jduck, including Metasploit module exploits/windows/browser/ms10_018_ie_tabular_activex.
AI-analyzed exploit summary This Metasploit module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data Control ActiveX (CVE-2010-0805) by overflowing the 'DataURL' parameter to execute arbitrary code via heap spraying and shellcode injection.
Description
The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote attackers to execute arbitrary code via a long URL (DataURL parameter) that triggers memory corruption in the CTDCCtl::SecurityCHeckDataURL function, aka "Memory Corruption Vulnerability."
Exploits (3)
This Metasploit module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data Control ActiveX (CVE-2010-0805) by overflowing the 'DataURL' parameter to execute arbitrary code via heap spraying and shellcode injection.
This exploit triggers a stack-based buffer overflow in the DataURL parameter of the ActiveX control (clsid:333C7BC4-460F-11D0-BC04-0080C7055A83) by providing an excessively long string, leading to arbitrary code execution. The vulnerability is in the handling of the DataURL parameter, allowing memory corruption.
This Metasploit module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data ActiveX Control (CVE-2010-0805) by writing a NUL byte outside array bounds via a long 'DataURL' parameter, leading to arbitrary code execution.