PT-2007-6415 · Microsoft · Internet Explorer

Publicado 2007-12-05 · Atualizado 2021-07-23 · CVE-2007-5355

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 7

Description: The issue concerns the Web Proxy Auto-Discovery (WPAD) feature. When a primary DNS suffix with three or more components is configured, it resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain. This allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.

Recommendations: For Microsoft Internet Explorer versions 6 through 7, consider disabling the WPAD feature as a temporary workaround until a patch is available. Restrict access to external WPAD servers to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-5355

Produtos afetados

Internet Explorer

Referências · 7

• http://support.microsoft.com/kb/945713 · Aviso do Fabricante
• http://secunia.com/advisories/27901 · Aviso do Fabricante
• http://microsoft.com/technet/security/advisory/945713.mspx · Nota
• http://securitytracker.com/id?1019033 · Nota
• http://securityfocus.com/bid/26686 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5355 · Nota de Segurança
• http://vupen.com/english/advisories/2007/4064 · Nota