Description: Paul has discovered a vulnerability in Internet Explorer, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.
The vulnerability is caused due to an error in the DHTML Edit ActiveX control when handling the "execScript()" function in certain situations. This can be exploited to execute arbitrary script code in a user's browser session in context of an arbitrary site.
This can further be exploited to execute arbitrary code by running malicious code in the "Local Machine" zone.
The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP1/SP2.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Provided and/or discovered by: Initially discovered by Liu Die Yu
Further research and PoC by Paul (from greyhats)
Changelog: 2004-12-20: Updated credits and solution.
2005-01-06: Added link to US-CERT vulnerability note. Added CVE reference.
2005-02-08: Microsoft released patches. Updated "Solution" and "Description" section.
2005-11-21: Added patch information for Windows XP Embedded.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
