PT-2004-1204 · Microsoft · Internet Explorer

Andreas Sandblad

·

Publicado

2004-01-08

·

Atualizado

2021-07-23

·

CVE-2003-1026

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Internet Explorer versions 5.01 through 6 SP1
Description The issue allows remote attackers to bypass zone restrictions. This is achieved via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back() function is called.
Recommendations For Internet Explorer versions 5.01 through 6 SP1, consider disabling javascript execution in sub-frames as a temporary workaround until a patch is available. Restrict access to sensitive zones to minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2003-1026

Produtos afetados

Internet Explorer