Internet Explorer System Compromise Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

Internet Explorer System Compromise Vulnerabilities
Secunia Advisory:	SA10289	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2003-11-25
Last Update:	2004-02-03
Popularity:	96,656 views

Critical:	Extremely critical
Impact:	Security Bypass Cross Site Scripting Exposure of sensitive information System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Microsoft Internet Explorer 5.01 Microsoft Internet Explorer 5.5 Microsoft Internet Explorer 6.x

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2003-1026 CVE-2003-1027

Description: Multiple vulnerabilities have been identified in Internet Explorer, which in combination can be exploited to compromise a user's system. 1) A redirection feature using the "mhtml:" URI handler can be exploited to bypass a security check in Internet Explorer, which normally blocks web pages in the "Internet" zone from parsing local files. 2) The above redirection feature can also be exploited to download and execute a malicious file on a user's system. Successful exploitation requires that script code can be executed in the "MyComputer" zone. 3) A cross-site scripting vulnerability can be exploited to execute script code in the security zone associated with another web page if it contains a subframe. This may potentially allow execution of script code in the "MyComputer" zone. 4) A variant of a fixed vulnerability can still be exploited to hijack a user's clicks and perform certain actions without the user's knowledge. For more information: SA9711 5) An error in the download functionality can be exploited to disclose a user's cache directory by supplying a "HTM" file extension and an invalid value in the "Content-Type:" header field. This issue does not affect all versions and may have been fixed by the latest patch for Internet Explorer. The vulnerabilities have been reported in Internet Explorer 6.0. However, other versions may also be affected and have been added due to the criticality of these issues. PoC exploits (Proof of Concept) are available. Solution: Apply patches manually or via WindowsUpdate. Internet Explorer 6 Service Pack 1: http://www.microsoft.com/downloads/de...-90D3-0C884910BC97&displaylang=en Internet Explorer 6 Service Pack 1 (64-Bit Edition): http://www.microsoft.com/downloads/de...-BC77-9BF410BC620D&displaylang=en Internet Explorer 6 for Windows Server 2003: http://www.microsoft.com/downloads/de...-B8F6-1DE327E598F0&displaylang=en Internet Explorer 6 for Windows Server 2003 (64-Bit Edition): http://www.microsoft.com/downloads/de...-9AE4-8DCB43404149&displaylang=en Internet Explorer 6: http://www.microsoft.com/downloads/de...-BFDE-29EBA8CF7A50&displaylang=en Internet Explorer 5.5 Service Pack 2: http://www.microsoft.com/downloads/de...-B767-5597DDE95C6F&displaylang=en Internet Explorer 5.01 Service Pack 4: http://www.microsoft.com/downloads/de...-9AA2-36D2D8454A92&displaylang=en Internet Explorer 5.01 Service Pack 3: http://www.microsoft.com/downloads/de...-8C0F-4183C77B6B51&displaylang=en Internet Explorer 5.01 Service Pack 2: http://www.microsoft.com/downloads/de...-A780-81D6DBC48DD5&displaylang=en Disable Active Scripting and allow it for only trusted sites. Provided and/or discovered by: Liu Die Yu Changelog: 2004-02-02: Microsoft issues patches for vulnerabilities 3 and 4. Added CVE references. 2004-02-03: Added link to CERT vulnerability note. Original Advisory: Microsoft Security Bulletin MS04-004: http://www.microsoft.com/technet/security/bulletin/MS04-004.asp http://www.safecenter.net/UMBRELLAWEB...y/originality/microsoft_ie/index.html http://www.safecenter.net/UMBRELLAWEBV4/1stCleanRc http://www.safecenter.net/UMBRELLAWEBV4/MhtRedirParsesLocalFile http://www.safecenter.net/UMBRELLAWEBV4/MhtRedirLaunchInetExe http://www.safecenter.net/UMBRELLAWEBV4/BackToFramedJpu http://www.safecenter.net/UMBRELLAWEBV4/HijackClickV2 http://www.safecenter.net/UMBRELLAWEBV4/threadid10008 http://www.safecenter.net/UMBRELLAWEBV4/LocalZoneInCache http://www.safecenter.net/UMBRELLAWEBV4/execdror6 Other References: SA9711: http://secunia.com/advisories/9711/ CERT VU#784102: http://www.kb.cert.org/vuls/id/784102

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

21st Nov, 2008

New advisories:	12
New vulnerabilities:	46
Updated advisories:	20

Highly // 1,018 views

Apple iPhone / iPod touch Multiple Vulnerabilities

Moderately // 550 views

vBulletin Visitor Messages Script Insertion Vulnerability

Less // 537 views

SemanticScuttle Cross-Site Scripting Vulnerabilities

Moderately // 527 views

Easyedit CMS Multiple SQL Injection Vulnerabilities

Highly // 541 views

Fedora update for thunderbird

Less // 578 views

IBM Workplace Web Content Management Cross-Site Scripting Vulnerabilities

Highly // 824 views

BitDefender Antivirus PDF Processing Memory Corruption Vulnerability

Moderately // 587 views

xt:Commerce SQL Injection Vulnerability

Less // 542 views

Softbiz Classifieds Script "msg" Cross-Site Scripting Vulnerability

Not // 760 views

Checkpoint VPN-1 Information Disclosure Vulnerability

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.