CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
99.3%
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a “data” tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
Vendor | Product | Version | CPE |
---|---|---|---|
microsoft | ie | 6.0 | cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:* |
microsoft | internet_explorer | 5.0.1 | cpe:2.3:a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:* |
microsoft | internet_explorer | 5.0.1 | cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:* |
microsoft | internet_explorer | 5.0.1 | cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:* |
microsoft | internet_explorer | 5.0.1 | cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:* |
microsoft | internet_explorer | 5.5 | cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:* |
microsoft | internet_explorer | 5.5 | cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:* |
microsoft | internet_explorer | 5.5 | cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:* |
microsoft | internet_explorer | 6.0 | cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:* |
lists.grok.org.uk/pipermail/full-disclosure/2003-September/009639.html
marc.info/?l=bugtraq&m=106304733121753&w=2
marc.info/?l=bugtraq&m=106304876523459&w=2
marc.info/?l=ntbugtraq&m=106302799428500&w=2
securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0310&L=ntbugtraq&F=P&S=&P=2169
www.osvdb.org/7872
www.securityfocus.com/bid/8556
docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-040
exchange.xforce.ibmcloud.com/vulnerabilities/13314
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A204