|
|
Info |
Last Modified |
| about 1 year ago |
|
|
|
|
|
Description |
Microsoft Internet Explorer contains a flaw that may allow a malicious user to execute arbitary commands on a user's system. The issue is triggered when a user accesses a maliciously crafted HTML page. It is possible that the flaw may allow execution of arbitary commands resulting in a loss of confidentiality, integrity, and/or availability.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
Internet Explorer does not properly handle object types, when rendering malicious popup windows. This may result in the possibility of the execution of malicious software.
The problem occurs when Internet Explorer receives a response from the server when a malicious popup window containing an object tag is parsed. Proper parameter checks of the type of file being loaded are not performed on the object type contained within HTTP response received from the web server.
|
|
Solution |
Microsoft has released a patch to address this issue. Additionally, it is possible to correct the flaw by implementing the following workaround(s):
Disable execution of activeX controls
|
|
Products |
|
Internet Explorer
 |
6.0 |
5.x |
6.0 SP1 |
|
|
|
|
Credit |
- http-equiv - http-equiv
 excite.com -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
