PT-2007-4383 · Microsoft · Internet Explorer

Published 2007-06-06 · Updated 2021-12-13 · CVE-2007-3092

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 6

Description: The issue allows remote attackers to spoof the URL bar and page properties, including SSL certificates, by interrupting page loading through certain use of location DOM objects and setTimeout calls. This can be leveraged for phishing and other attacks.

Recommendations: For Microsoft Internet Explorer version 6, consider disabling the use of location DOM objects and setTimeout calls as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-3092

Affected Products

Internet Explorer

References · 10

• 🔥 http://securityreason.com/securityalert/2781 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3092 · Security Note
• http://lcamtuf.coredump.cx/ietrap2 · Note
• http://osvdb.org/45437 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34705 · Note
• http://securityfocus.com/archive/1/470446/100/0/threaded · Note
• http://securityfocus.com/bid/24298 · Note
• http://secunia.com/advisories/25564 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html · Note
• http://securitytracker.com/id?1018193 · Note