Microsoft Internet Explorer executes scripts when scripting has been disabled after bypassing initial security checks

Overview

A vulnerability exists in Microsoft Internet Explorer that could permit an attacker to execute arbitrary script, even if the user has specifically disabled active scripting.

Description

Internet Explorer permits users to customize settings that enable and disable the ability of scripts to run on a web site. A vulnerability exists in Microsoft Internet Explorer, versions 5.5 up to and including SP2 and version 6, that could permit an attacker to execute arbitrary script, even if the user has specifically disabled active scripting.

---

Impact

A remote attacker can execute arbitrary script even though the user has disabled active scripting. Note that the script will still obey all zone restrictions for the domain.

---

Solution

Apply the patch specified in Microsoft’s Security Bulletin (MS02-005).

---

Vendor Information

355971

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: September 30, 2002

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Microsoft’s Security Bulletin (MS02-005).

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23355971 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.securityfocus.com/bid/4082&gt;
• <http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-005.asp&gt;

Acknowledgements

This vulnerability was reported in a Microsoft Security Bulletin.

This document was written by Jason A Rafail.

Other Information

CVE IDs:	CVE-2002-0026
Severity Metric:	20.88 Date Public: