Executive Summary

Informations
Name	MS01-058	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

13 December 2001 Cumulative Patch for IE

OVAL Definitions

 

Definition Id: oval:org.mitre.oval:def:1014
Oval ID:	oval:org.mitre.oval:def:1014
Title:	IE File Download Dialog Deception Vulnerability
Description:	Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2001-0875	Version:	5
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Software section the version of mshtml.dll is less than 6.0.2712.0300 AND NOT Patch Q313675 Installed AND NOT Patch Q316059.exe Installed AND NOT Patch Q319282 Installed AND NOT the patch q321232 is installed (Installed Components key) AND NOT the patch q323759 is installed (Installed Components key) AND NOT the patch q328970 is installed (Installed Components key) AND NOT the patch q324929 is installed (Installed Components key) AND NOT the patch q810847 is installed (Installed Components key) AND NOT the patch q813489 is installed (Installed Components key) AND NOT the patch q818529 is installed (Installed Components key) AND NOT the patch q822925 is installed (Installed Components key) AND NOT the patch q828750 is installed (Installed Components key) AND NOT the patch q824145 is installed (Installed Components key) AND NOT the patch q832894 is installed (Installed Components key) AND Internet Explorer 6 is installed AND Configuration section File Downloads Not Disabled Use Machine Settings AND File Downloads Allowed In At Least One Zone

 

Definition Id: oval:org.mitre.oval:def:921
Oval ID:	oval:org.mitre.oval:def:921
Title:	IE File Execution User-prompt Bypass Vulnerability
Description:	Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the "File Execution Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2001-0727	Version:	5
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Microsoft Internet Explorer 6 is installed AND the version of mshtml.dll is less than 6.0.2712.0300 AND NOT Patch Q313675 Installed AND NOT Patch Q316059.exe Installed AND NOT Patch Q319282 Installed AND NOT the patch q321232 is installed (Installed Components key) AND NOT the patch q323759 is installed (Installed Components key) AND NOT the patch q328970 is installed (Installed Components key) AND NOT the patch q324929 is installed (Installed Components key) AND NOT the patch q810847 is installed (Installed Components key) AND NOT the patch q813489 is installed (Installed Components key) AND NOT the patch q818529 is installed (Installed Components key) AND NOT the patch q822925 is installed (Installed Components key) AND NOT the patch q828750 is installed (Installed Components key) AND NOT the patch q824145 is installed (Installed Components key) AND NOT the patch q832894 is installed (Installed Components key) AND Use Machine Settings AND File Downloads Allowed In At Least One Zone

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Internet Explorer cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*	2

SAINT Exploits

Description	Link
Internet Explorer inline content filename extension vulnerability	More info here

OpenVAS Exploits

Date	Description
2005-11-03	Name : IE 5.01 5.5 6.0 Cumulative patch (890923) File : nvt/smb_nt_ms02-005.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
3033	Microsoft IE Content Type/Disposition File Execution Microsoft Internet Explorer contains a flaw that allows remote attackers to cause a file to be automatically downloaded and executed on a vulnerable system. The issue is due to IE incorrectly handling the "Content-Type" and "Content-Disposition" HTTP header fields. By modifying these headers, an attacker can create a HTML document that would cause IE to download and execute the files without any security considerations.
2004	Microsoft IE Remote File Viewing
1995	Microsoft IE Spoofable File Extensions