CERT-In Vulnerability Note
CIVN-2004-0073
Internet Explorer DHTML Edit ActiveX Control Cross-Site Scripting vulnerability
Original Issue Date:December 20, 2004
Severity Rating: HIGH
Systems Affected
Microsoft Internet Explorer 6
Overview
A vulnerability is reported in Internet Explorer 'DHTML Edit ActiveX' control resulting in possible cross site scripting attack.
Description
The vulnerability in Microsoft Internet Explorer causes due to error in the DHTML Edit ActiveX control "execScript " function. To exploit this vulnerability a remote attacker creates html webpage having an ActiveX control to execute the arbitrary code on the users browser, which could be used to conduct a cross site scripting attack. This vulnerability may also be exploited for phishing attacks.
As per Secunia this vulnerability could exploit fully patched system with Microsoft Windows XP SP1/SP2 and Internet Explorer 6.0.
Workaround
- Set security level to high for the "Internet" zone and disable ActiveX support. Disable the DHTML Edit Control
- Activate local machine zone lockdown feature in Windows XP Service Pack 2 SP2
- Read and send email in plain text format
- Do not follow unsolicited links
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS05-013
Vendor Information
Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms05-013.mspx
References
Securitytracker advisory
http://securitytracker.com/alerts/2004/Dec/1012584.html
Secunia advisory
http://secunia.com/advisories/13482/
Securityfocus
http://www.securityfocus.com/bid/11950
US-CERT Vulnerability Note VU#356600
http://www.kb.cert.org/vuls/id/356600
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|