PT-2007-4382 · Microsoft · Internet Explorer

David Bloom · Published 2007-06-06 · Updated 2023-12-07 · CVE-2007-3091

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 SP1 through 7 for Windows XP SP2 and SP3 Microsoft Internet Explorer versions 6 and 7 for Server 2003 SP2 Microsoft Internet Explorer version 7 for Vista Gold, SP1, and SP2 Microsoft Internet Explorer version 7 for Server 2008 SP2

Description: The issue allows remote attackers to execute arbitrary code or perform other actions upon a page transition, with the permissions of the old page and the content of the new page. This can be demonstrated by setInterval functions that set location.href within a try/catch expression. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. The attacker could view data from a Web page in another Internet Explorer domain.

Recommendations: For Microsoft Internet Explorer versions 6 SP1 through 7 for Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Internet Explorer versions 6 and 7 for Server 2003 SP2, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 7 for Vista Gold, SP1, and SP2, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 7 for Server 2008 SP2, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the use of setInterval functions that set location.href within a try/catch expression until a patch is available.

Fix

RCE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2007-3091

Affected Products

Internet Explorer

References · 20

• http://vupen.com/english/advisories/2009/1538 · Vendor Advisory
• http://secunia.com/advisories/25564 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019 · Vendor Advisory
• http://securityfocus.com/bid/24283 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3091 · Security Note
• http://vupen.com/english/advisories/2007/2064 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3091 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34696 · Note
• http://osvdb.org/38497 · Note
• http://kb.cert.org/vuls/id/471361 · Note
• http://lcamtuf.coredump.cx/ierace · Note
• http://osvdb.org/54944 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html · Note
• http://securitytracker.com/id?1018192 · Note
• http://securityreason.com/securityalert/2781 · Note