SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Microsoft Internet Explorer Vendors:   Microsoft
Microsoft Windows Internet Explorer May Let Remote Users Obfuscate the Download Dialog Box
SecurityTracker Alert ID:  1015349
SecurityTracker URL:  http://securitytracker.com/id/1015349
CVE Reference:   CVE-2005-2829   (Links to External Site)
Date:  Dec 13 2005
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.01 SP4, 5.5 SP2, 6 SP1; and prior service packs
Description:   A vulnerability was reported in Microsoft Internet Explorer. A remote user may be able to cause files to be downloaded to the target user's system or arbitrary code to be executed by the target user.

Internet Explorer may display file download dialog boxes and accept user input in such a manner that a remote user can obfuscate the dialog box and cause an arbitrary file to be downloaded to the target user's system. Some user interaction is required.

This can potentially be exploited to cause arbitrary code to be executed by the target user.

Microsoft credits Andreas Sandblad and Jakob Balle of Secunia with reporting this vulnerability.

Impact:   A remote user can cause files to be downloaded to the target user's system.

A remote user can cause arbitrary code to be executed by the target user.

Solution:   The vendor has issued the following fixes:

Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4:

http://www.microsoft.com/downloads/details.aspx?FamilyId=4005B74A-D6E6-4A32-A3B1-276686B4A428

Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 or on Microsoft Windows XP Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=A8443CD2-D98D-427B-9F0E-BD7E19FCB994

Internet Explorer 6 for Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=E4B5BA57-D4F2-4798-9154-2869E371C9D1

Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9D70FB20-C7C9-43AF-A864-6DBC9A542CC6

Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?FamilyId=1EE790B9-E596-4344-AEC3-FCB3289D7E9C

Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=8E9C23E5-7988-42DA-A8BD-2C1A534BF995

Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=E1652B4A-6339-4B31-8ACF-D2A844C24F70

A restart is required.

This cumulative update supercedes the update provided in MS05-052.

Vendor URL:  www.microsoft.com/technet/security/Bulletin/MS05-054.mspx (Links to External Site)
Cause:   State error
Underlying OS:  Windows (98), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC