PT-2004-1657 · Microsoft · Mshtml+1
Jelmer
+1
·
Published
2004-06-15
·
Updated
2021-07-23
·
CVE-2004-0549
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Internet Explorer version 6
Description
The issue allows remote attackers to execute arbitrary code in the Local Security context. This can be achieved by using the
showModalDialog method and modifying the location to execute code, such as Javascript. The exploitation can occur through delayed HTTP redirect operations or by modifying the location attribute of the window object.Recommendations
For Internet Explorer version 6, consider disabling the
showModalDialog method as a temporary workaround until a patch is available. Restrict access to the MSHTML engine to minimize the risk of exploitation. Avoid using the location attribute of the window object in affected scenarios until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Internet Explorer
Mshtml