PT-2003-1516 · Microsoft · Internet Explorer

Marek Bialoglowy · Published 2003-05-17 · Updated 2021-07-23 · CVE-2003-0309

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.01 through 6.0

Description: The issue allows remote attackers to bypass security zone restrictions and execute arbitrary programs via a web document with a large number of duplicate file:// or other requests. This can be achieved by opening multiple file download dialogs, which eventually cause the program to be executed. The exploitation can be demonstrated using a large number of FRAME or IFRAME tags.

Recommendations: For Internet Explorer versions 5.01 through 6.0, consider disabling the execution of files from the internet zone as a temporary workaround until a patch is available. Restrict access to the file download dialog to minimize the risk of exploitation. Avoid using multiple FRAME or IFRAME tags in web documents to prevent bypassing security zone restrictions.

Exploit

Fix

Related Identifiers

CVE-2003-0309

Affected Products

Internet Explorer

References · 11

• 🔥 https://exploit-db.com/exploits/22575 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-0309 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-020 · Vendor Advisory
• http://marc.info/?l=ntbugtraq&m=105294162726096&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12019 · Note
• http://marc.info/?l=bugtraq&m=105249399103214&w=2 · Note
• http://secunia.com/advisories/8807 · Note
• http://kb.cert.org/vuls/id/251788 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A948 · Note
• http://marc.info/?l=bugtraq&m=105294081325040&w=2 · Note
• http://securityfocus.com/bid/7539 · Note