PT-2008-6615 · Microsoft · Internet Explorer

Published 2008-12-12 · Updated 2018-10-11 · CVE-2008-5554

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8.0 Beta 2

Description The issue allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks by not properly handling some HTTP headers that appear after a CRLF sequence in a URI. This can be achieved through the Location and Set-Cookie HTTP headers.

Recommendations For Microsoft Internet Explorer version 8.0 Beta 2, consider disabling the XSS Filter as a temporary workaround until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation. Avoid using HTTP headers that may trigger this issue in the affected versions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-5554

Affected Products

Internet Explorer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-5554 · Security Note
• http://securityfocus.com/archive/1/499124/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47277 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47443 · Note