Secunia Logo  
 Vulnerability InformationVulnerability ScanningCommunityBlog - new entry!Corporate InformationOnline ShopCustomer Login  
 Secunia AdvisoriesSecunia ResearchBinary Analysis  
Home > Vulnerability Information > Secunia Advisories > Microsoft Internet Explorer Multiple Vulnerabilities
Secunia Advisories
Advisories
Search
Advisories by Product
Advisories by Vendor
Historic Advisories
Mailing Lists
Report Vulnerability
Contact Form
Business Solutions Restricted
Partner Solutions Restricted
About


Secunia PSI WorldMap 		 
Microsoft Internet Explorer Multiple Vulnerabilities
Secunia Advisory: SA12889
Advisory Toolbox:
Issue ticket
Save in to-do list
Mark as handled
Exploit information
Download as PDF
Review actions
Add comment
Release Date: 2004-10-20
Last Update: 2005-11-21
Popularity: 330,115 views

Critical:
Extremely critical
Impact: Security Bypass
Cross Site Scripting
System access
Where: From remote
Solution Status: Vendor Patch

Software:Microsoft Internet Explorer 6.x
Secunia CVSS-2 Score: Available in Secunia business solutions

Subscribe: Instant alerts on relevant vulnerabilities


Advisory Content (Page 2 of 3)[ 1 ] [ 2 ] [ 3 ]

Solution:
1) Microsoft has issued patches, for more information:
SA11165
SA14190

2, 3) Apply patches.

Microsoft Windows 2000 (requires Service Pack 3 or Service Pack 4):
http://www.microsoft.com/downloads/de...=BE1B11C0-EF09-4295-8FB2-0FF17BA65460

Microsoft Windows XP (requires Service Pack 1or Service Pack 2):
http://www.microsoft.com/downloads/de...=43201B00-298D-4C0C-A26F-AAEDF163FEB7

Microsoft Windows XP 64-Bit Edition (requires Service Pack 1):
http://www.microsoft.com/downloads/de...=1FC58C5F-3A97-4B89-96C3-AAEFFCE28535

Microsoft Windows XP 64-Bit Edition Version 2003:
http://www.microsoft.com/downloads/de...=3B3878C9-57FB-45A9-B5C2-234AD538D6CC

Microsoft Windows XP Embedded SP2:
http://www.microsoft.com/downloads/de...=dcf129e8-17b7-4e37-9674-95f41169ec55

Microsoft Windows XP Embedded SP1:
http://www.microsoft.com/downloads/de...=aed17ac4-2061-467b-9127-92b539e56f0a

Microsoft Windows Server 2003:
http://www.microsoft.com/downloads/de...=23E619FE-F6DB-4666-A247-339F55B059CC

Microsoft Windows Server 2003 64-Bit Edition:
http://www.microsoft.com/downloads/de...=3B3878C9-57FB-45A9-B5C2-234AD538D6CC

Microsoft Windows NT Server 4.0 (requires Service Pack 6a) and Microsoft Windows NT Server 4.0 Terminal Server Edition (requires Service Pack 6):
http://www.microsoft.com/downloads/de...=7B2C22A9-98C6-4661-9B8D-6C59C8812071

Provided and/or discovered by:
1) Discovered independently by:
* http-equiv
* Andreas Sandblad of Secunia Research (reported to Microsoft on 2004-10-13).

2) Discovered by:
* http-equiv

Additional information provided by:
* Roozbeh Afrasiabi

3) Discovered by:
* Paul, Greyhats Security
* Michael Evanchik

Additional information provided by:
* ShredderSub7

Changelog:
2004-10-21: Updated advisory.
2004-10-28: Added another workaround in "Solution" section and linked to Microsoft Knowledge Base article.
2004-11-02: Updated with additional information in "Description" and "Solution" section.
2004-11-29: Updated "Description" section with additional information from Paul.
2004-12-23: Added link to US-CERT vulnerability note.
2004-12-25: Updated "Description" section with additional information from Paul and Michael Evanchik.
2005-01-07: Increased rating. Added link to test. Updated "Description" and "Solution" sections.
2005-01-11: Updated solution. Microsoft has issued patches for issue 2 and 3.
2005-01-12: Added link to US-CERT vulnerability note.
2005-02-08: Microsoft issued patches.
2005-11-21: Added patch information for Windows XP Embedded.

Original Advisory:
MS05-001 (KB890175):
http://www.microsoft.com/technet/security/Bulletin/MS05-001.mspx

MS05-014 (KB867282):
http://www.microsoft.com/technet/security/bulletin/ms05-014.mspx

3) http://freehost07.websamba.com/greyhats/sp2rc-analysis.htm

Other References:
SA12321:
http://secunia.com/advisories/12321/

SA11165:
http://secunia.com/advisories/11165/

SA14190:
http://secunia.com/advisories/14190/

How to Disable "Drag and Drop or copy and paste files" option in Internet Explorer:
http://support.microsoft.com/kb/888534

How to Disable Active Content in Internet Explorer:
http://support.microsoft.com/default.aspx?scid=kb;en-us;q154036

US-CERT VU#939688:
http://www.kb.cert.org/vuls/id/939688

US-CERT VU#972415:
http://www.kb.cert.org/vuls/id/972415

Change Page:
[ 1 ] [ 2 ] [ 3 ]


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Today
New advisories: 2
New vulnerabilities: 3
Updated advisories: 5

Less // 52 views
Fedora update for snort
Not // 58 views
Fedora update for asterisk

23rd Nov, 2009
New advisories: 16
New vulnerabilities: 116
Updated advisories: 34

Moderately // 279 views
Magic Music Player Playlist Processing Buffer Overflow Vulnerability
Moderately // 276 views
FMOD Ex Playlist Processing Multiple Vulnerabilities
Moderately // 255 views
IP.Board SQL Injection Vulnerabilities
Moderately // 737 views
Firefox infoRSS Extension Cross-Context Scripting Vulnerability
Highly // 282 views
Outreach Project Tool "CRM_path" File Inclusion Vulnerability
Less // 385 views
Sun Solaris OpenSSL TLS Session Renegotiation Plaintext Injection Vulnerability
Highly // 374 views
PHP Traverser "GLOBALS[BASE]" File Inclusion Vulnerability
Moderately // 626 views
Opera Multiple Vulnerabilities

Solutions | More...  

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Internet Explorer Layout Handling Memory Corruption Vulnerability // 95 views
2. Firefox infoRSS Extension Cross-Context Scripting Vulnerability // 75 views
3. Internet Explorer Three Vulnerabilities // 73 views
4. Opera Multiple Vulnerabilities // 57 views
5. Fedora update for asterisk // 51 views
6. Fedora update for snort // 46 views
7. Kaspersky Anti-Virus 2010 klavemu.kdl Denial of Service Vulnerability // 37 views
8. VMware ESXi update for ntp // 32 views
9. VMware ESX and vMA Update for Multiple Packages // 29 views
10. Internet Explorer Charset Inheritance Cross-Site Scripting Vulnerability // 25 views



Contact | Terms & Conditions and Copyright | Report Vulnerability | Press | Jobs (open positions) | About Secunia
Copyright Secunia 2002-2009