Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2004-0549 | First vendor Publication | 2004-08-06 |
| Vendor | Cve | Last vendor Modification | 2021-07-23 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0549 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1133 | |||
| Oval ID: | oval:org.mitre.oval:def:1133 | ||
| Title: | Scob and Toofer Internet Explorer v6.0,SP1 Vulnerabilities | ||
| Description: | The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2004-0549 | Version: | 5 |
| Platform(s): | Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:207 | |||
| Oval ID: | oval:org.mitre.oval:def:207 | ||
| Title: | Scob and Toofer Internet Explorer v6.0,SP1 for Server 2003 Vulnerabilities | ||
| Description: | The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2004-0549 | Version: | 6 |
| Platform(s): | Microsoft Windows Server 2003 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:241 | |||
| Oval ID: | oval:org.mitre.oval:def:241 | ||
| Title: | Scob and Toofer Internet Explorer v5.5,SP2 Vulnerabilities | ||
| Description: | The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2004-0549 | Version: | 3 |
| Platform(s): | Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:519 | |||
| Oval ID: | oval:org.mitre.oval:def:519 | ||
| Title: | Scob and Toofer Internet Explorer v6.0 Vulnerabilities | ||
| Description: | The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2004-0549 | Version: | 4 |
| Platform(s): | Microsoft Windows XP | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2005-11-03 | Name : IE 5.01 5.5 6.0 Cumulative patch (890923) File : nvt/smb_nt_ms02-005.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 8275 | Microsoft IE Navigation Cross Domain Execution (InsiderPrototype) Internet Explorer contains a flaw that may allow a malicious web site operator to execute arbitrary code on a client PC. The issue is triggered when an attacker exploits a flaw in the IE cross-domain security model by using the showModalDialog method to modify the location to execute code. This can be done via delayed HTTP redirect operations and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or modifying the location attribute of the window. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
| 6963 | Microsoft IE Address Bar Spoofing |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Internet Explorer ADODB.Stream ActiveX function call access RuleID : 8063 - Revision : 19 - Type : BROWSER-PLUGINS |
| 2014-01-10 | ADODB.Stream ActiveX CLSID unicode access RuleID : 8062 - Revision : 7 - Type : WEB-ACTIVEX |
| 2014-01-10 | Microsoft Internet Explorer Adodb.Stream ActiveX Object Access CreateObject F... RuleID : 4983 - Revision : 11 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft Internet Explorer Adodb.Stream ActiveX object access RuleID : 4982 - Revision : 13 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft Internet Explorer bitmap BitmapOffset multipacket integer overflow ... RuleID : 3685 - Revision : 14 - Type : BROWSER-IE |
| 2014-01-16 | Microsoft Internet Explorer malformed GIF double-free remote code execution a... RuleID : 28975 - Revision : 2 - Type : BROWSER-IE |
| 2014-01-16 | Microsoft Internet Explorer malformed GIF double-free remote code execution a... RuleID : 28974 - Revision : 3 - Type : BROWSER-IE |
| 2014-01-16 | Microsoft Internet Explorer malformed GIF double-free remote code execution a... RuleID : 28973 - Revision : 2 - Type : BROWSER-IE |
| 2014-01-16 | Microsoft Internet Explorer malformed GIF double-free remote code execution a... RuleID : 28972 - Revision : 3 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer bitmap BitmapOffset integer overflow attempt RuleID : 2671-community - Revision : 18 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer bitmap BitmapOffset integer overflow attempt RuleID : 2671 - Revision : 18 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer bitmap BitmapOffset integer overflow attempt RuleID : 25853 - Revision : 2 - Type : BROWSER-IE |
| 2014-01-10 | local resource redirection attempt RuleID : 2577-community - Revision : 10 - Type : FILE-OTHER |
| 2014-01-10 | local resource redirection attempt RuleID : 2577 - Revision : 10 - Type : FILE-OTHER |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-07-23 21:25:03 |
|
| 2021-07-23 17:24:41 |
|
| 2021-05-04 12:02:20 |
|
| 2021-04-22 01:02:30 |
|
| 2020-05-23 00:15:48 |
|
| 2018-10-13 00:22:29 |
|
| 2017-10-11 09:23:21 |
|
| 2017-07-11 12:01:27 |
|
| 2016-10-18 12:01:20 |
|
| 2016-04-26 12:50:54 |
|
| 2014-01-19 21:22:13 |
|
| 2013-05-11 11:42:01 |
|
