PT-2008-6615 · Microsoft · Internet Explorer

Publicado 2008-12-12 · Atualizado 2018-10-11 · CVE-2008-5554

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8.0 Beta 2

Description The issue allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks by not properly handling some HTTP headers that appear after a CRLF sequence in a URI. This can be achieved through the Location and Set-Cookie HTTP headers.

Recommendations For Microsoft Internet Explorer version 8.0 Beta 2, consider disabling the XSS Filter as a temporary workaround until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation. Avoid using HTTP headers that may trigger this issue in the affected versions until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-5554

Produtos afetados

Internet Explorer

Referências · 4

• http://securityfocus.com/archive/1/499124/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5554 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47277 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47443 · Nota