PT-2005-4123 · Microsoft · Internet Explorer

Marc Ruef + 1 · Published 2005-10-26 · Updated 2021-07-23 · CVE-2005-3312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 6.0

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted image and audio files, such as .GIF, JPG, and WAV. These files are rendered as HTML when the user clicks on the link, despite the web server response and file extension indicating that they should be treated as a different file type.

Recommendations For Microsoft Internet Explorer version 6.0, consider disabling the rendering of HTML in files with non-HTML extensions as a temporary workaround until a patch is available. Restrict access to potentially corrupted files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-3312

Affected Products

Internet Explorer

References · 6

• 🔥 http://computec.ch/download.php?view.683 · Exploit
• 🔥 http://scip.ch/cgi-bin/smss/showadvf.pl?id=1746 · Exploit
• http://securiteam.com/windowsntfocus/6F00B00EBY.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3312 · Security Note
• http://securityreason.com/securityalert/18 · Note
• http://marc.info/?l=bugtraq&m=113017003617987&w=2 · Note