PT-2008-3103 · Microsoft · Internet Explorer

Published 2008-03-28 · Updated 2023-12-07 · CVE-2008-1544

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 through 7

Description The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name. This allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, access arbitrary virtual hosts via a modified Host header, bypass referrer restrictions via an incorrect Referer header, and bypass the same-origin policy and obtain sensitive information via a crafted request header. An information disclosure vulnerability exists in the way Internet Explorer handles certain request headers, which could allow an attacker to read data from another Internet Explorer domain by constructing a specially crafted Web page.

Recommendations For Microsoft Internet Explorer versions 5.01 through 7, consider disabling the setRequestHeader method of the XMLHttpRequest object as a temporary workaround until a patch is available. Restrict access to sensitive information and virtual hosts to minimize the risk of exploitation. Avoid using crafted request headers in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1544

Affected Products

Internet Explorer

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2008-1544 · Security Note
• http://marc.info/?l=bugtraq&m=121380194923597&w=2 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1778 · Vendor Advisory
• http://secunia.com/advisories/29453 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0980 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1544 · Security Note
• http://securityfocus.com/bid/28379 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-031 · Vendor Advisory
• http://securitytracker.com/id?1020226 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-031 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5291 · Note
• http://us-cert.gov/cas/techalerts/TA08-162B.html · Note
• http://securityreason.com/securityalert/3785 · Note
• http://securityfocus.com/archive/1/489954/100/0/threaded · Note
• http://mindedsecurity.com/MSA02240108.html · Note