PT-2005-2758 · Microsoft · Internet Explorer

Benjamin Tobias Franz · Published 2005-06-01 · Updated 2021-07-23 · CVE-2005-1790

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions prior to 6.0.2900.2180

Description The issue allows remote attackers to cause a denial of service and execute arbitrary code via a Javascript BODY onload event that calls the window function.

Recommendations For versions prior to 6.0.2900.2180, update to a version that is not affected by this issue to prevent exploitation. As a temporary workaround, consider disabling Javascript or restricting the use of the window function in the BODY onload event until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2005-1790

Affected Products

Internet Explorer

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms05_054_onload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/18365 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-054 · Vendor Advisory
• http://vupen.com/english/advisories/2005/2509 · Vendor Advisory
• http://secunia.com/advisories/18064 · Vendor Advisory
• http://secunia.com/advisories/18311 · Vendor Advisory
• http://vupen.com/english/advisories/2005/2867 · Vendor Advisory
• http://secunia.com/advisories/15546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1790 · Security Note
• http://vupen.com/english/advisories/2005/2909 · Vendor Advisory
• http://secunia.com/advisories/15368 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1091 · Note
• http://us-cert.gov/cas/techalerts/TA05-347A.html · Note
• http://securityfocus.com/bid/13799 · Note
• http://marc.info/?l=bugtraq&m=111755552306013&w=2 · Note