search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Internet Explorer createTextRange() vulnerability

Vulnerability Note VU#876678

Original Release Date: 2006-03-23 | Last Revised: 2006-04-11


Microsoft Internet Explorer (IE) fails to properly handle the createTextRange() DHTML method, possibly allowing a remote, unauthenticated attacker to execute arbitrary code.


DHTML, TextRanges, and the createTextRange Method

According to Microsoft:

Dynamic HTML (DHTML) is built on an object model that extends the traditional static HTML document which enables Web authors to create more engaging and interactive Web pages.
A TextRange is a DHTML object that represents text. createTextRange() is a DHTML method to generate a TextRange for a DHTML Object.

The Problem

IE fails to properly handle the createTextRange() method. When this method is called for certain DHTML objects, memory may be corrupted in a way that could allow an attacker to execute arbitrary code.

More information is available in Microsoft Security Bulletin MS06-013 and Microsoft Security Advisory 917077.

Note that working exploit code is available for this vulnerability.


By convincing a user to open a specially crafted web page, a remote unauthenticated attacker can execute arbitrary code on a vulnerable system.


Apply an Update
This issue is addressed in Microsoft Security Bulletin MS06-013.

Disable Active Scripting

Known attack vectors for this vulnerability require Active Scripting to be enabled. By disabling Active Scripting, the chances of exploitation are reduced. For instructions on how to disable Active Script in Internet Explorer, please refer to the Internet Explorer section of the Securing Your Web Browser document.

Additional workarounds are available in Microsoft Security Advisory 917077.

Read and send email in plain text format

An attacker may be able to exploit this vulnerability by convincing a user to open a specially crafted HTML email. Only reading email in plaintext will prevent exploitation of this vulnerability through email. Consider the security of fellow Internet users and send email in plain text format when possible.

If you use Microsoft Outlook, we encourage you to apply the Outlook Email Security Update. The update configures Outlook to open email messages in the Restricted Sites Zone, where Active scripting is disabled by default. In addition, the update provides further protection against malicious code that attempts to propagate via Outlook. The Outlook Email Security Update is available for Outlook 98 and Outlook 2000. The functionality of the Outlook Email Security Update is included in Outlook 2002 and Outlook Express 6. Outlook 2003 includes these and other security enhancements.

Do not follow unsolicited links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.

Vendor Information


Microsoft Corporation Affected

Notified:  March 22, 2006 Updated: April 11, 2006



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Please see

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This issue was reported by Andreas Sandblad of Secunia Researcha.

This document was written by Jeff Gennari.

Other Information

CVE IDs: CVE-2006-1359
Severity Metric: 35.63
Date Public: 2006-03-22
Date First Published: 2006-03-23
Date Last Updated: 2006-04-11 20:14 UTC
Document Revision: 46

Sponsored by CISA.