Microsoft Windows Internet Explorer May Let Remote Users Obfuscate the Download Dialog Box
|
|
SecurityTracker Alert ID: 1015349
|
|
SecurityTracker URL: http://securitytracker.com/id?1015349
|
|
CVE Reference: CVE-2005-2829
(Links to External Site)
|
Date: Dec 13 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 5.01 SP4, 5.5 SP2, 6 SP1; and prior service packs
|
Description: A vulnerability was reported in Microsoft Internet Explorer. A remote user may be able to cause files to be downloaded to the target user's system or arbitrary code to be executed by the target user.
Internet Explorer may display file download dialog boxes and accept user input in such a manner that a remote user can obfuscate
the dialog box and cause an arbitrary file to be downloaded to the target user's system. Some user interaction is required.
This
can potentially be exploited to cause arbitrary code to be executed by the target user.
Microsoft credits Andreas Sandblad and
Jakob Balle of Secunia with reporting this vulnerability.
|
Impact: A remote user can cause files to be downloaded to the target user's system.
A remote user can cause arbitrary code to be executed by the target user.
|
Solution: The vendor has issued the following fixes:
Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details
.aspx?FamilyId=4005B74A-D6E6-4A32-A3B1-276686B4A428
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack
4 or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A8443CD2-D98D-427B-9F0E-BD7E19FCB994
Internet
Explorer 6 for Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E4B5BA57-D4F2-4798-9154-2869E371C9D1
Internet
Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9D70FB20-C7C9-4
3AF-A864-6DBC9A542CC6
Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server
2003 with SP1 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1EE790B9-E596-4344-AEC3-FCB3289D7E9C
Internet
Explorer 6 for Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8E9C23E5-7988-42DA-A8BD-2C1A534BF995
Internet
Explorer 6 for Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E1652B4A-6339-4B31-8ACF-D2A844C24F70
A
restart is required.
This cumulative update supercedes the update provided in MS05-052.
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-054.mspx (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (98), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 13 Dec 2005 02:08:37 -0500
Subject: MS05-054
|
http://www.microsoft.com/technet/security/Bulletin/MS05-054.mspx
|
|
