PT-2008-3104 · Microsoft · Internet Explorer

Stefano Di Paola · Published 2008-03-28 · Updated 2021-07-23 · CVE-2008-1545

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 7

Description The issue concerns the setRequestHeader method of the XMLHttpRequest object, which fails to restrict the dangerous Transfer-Encoding HTTP request header. This allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks by sending a POST request containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.

Recommendations For Microsoft Internet Explorer 7, consider disabling the use of the setRequestHeader method for the XMLHttpRequest object until a fix is available, or avoid using the Transfer-Encoding header in requests to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1545

Affected Products

Internet Explorer

References · 7

• 🔥 http://mindedsecurity.com/MSA01240108.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1545 · Security Note
• http://secunia.com/advisories/29453 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42804 · Note
• http://vupen.com/english/advisories/2008/0980 · Note
• http://securityfocus.com/archive/1/489960/100/0/threaded · Note
• http://securityreason.com/securityalert/3786 · Note