PT-2004-2132 · Microsoft · Internet Explorer

Published 2004-12-15 · Updated 2021-07-23 · CVE-2004-1173

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Internet Explorer version 6

Description: The issue allows remote attackers to bypass the popup blocker using the document object model (DOM) methods in the DHTML Dynamic HTML (DHTML) Editing Component (DEC) and Javascript that calls showModalDialog().

Recommendations: For Internet Explorer version 6, consider disabling the DHTML Editing Component (DEC) as a temporary workaround until a patch is available. Restrict access to the showModalDialog() function in Javascript to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1173

Affected Products

Internet Explorer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2004-1173 · Security Note
• http://marc.info/?l=bugtraq&m=110271114525795&w=2 · Note
• http://marc.info/?l=ntbugtraq&m=110271016129952&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18444 · Note