OSVDB ID: 7774 Title: Microsoft IE Popup.show() Click Hijack (HijackClick 3) |
Info |
|
|
Dates |
||||
|
|
Description |
Microsoft Internet Explorer contains a flaw that may allow a malicious user to induce a drag-and-drop event within the browser. The issue is triggered when the victim clicks on a link with the popup.show() function defined as an onMouseclick event. It is possible that the flaw may allow an attacker to deliver executable code to the victim's computer without further user interaction, resulting in a loss of integrity. |
Classification |
Location:
Local Access Required,
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Currently, there are no known upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. Also, it is possible to correct the flaw by implementing the following workaround: Disable ActiveX controls and Active Scripting for untrusted web sites. |
Products |
|
References |
|
Credit |
|
greyhats.cjb.net - Personal Site