PT-2008-3104 · Microsoft · Internet Explorer

Stefano Di Paola · Publicado 2008-03-28 · Atualizado 2021-07-23 · CVE-2008-1545

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 7

Description The issue concerns the setRequestHeader method of the XMLHttpRequest object, which fails to restrict the dangerous Transfer-Encoding HTTP request header. This allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks by sending a POST request containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.

Recommendations For Microsoft Internet Explorer 7, consider disabling the use of the setRequestHeader method for the XMLHttpRequest object until a fix is available, or avoid using the Transfer-Encoding header in requests to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-1545

Produtos afetados

Internet Explorer

Referências · 7

• 🔥 http://mindedsecurity.com/MSA01240108.html · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42804 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1545 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0980 · Nota
• http://securityfocus.com/archive/1/489960/100/0/threaded · Nota
• http://securityreason.com/securityalert/3786 · Nota
• http://secunia.com/advisories/29453 · Aviso do Fabricante