OSVDB ID: 17094 Title: Microsoft IE window() Function Arbitrary Code Execution |
Info |
|
|
Dates |
||||
|
|
Description |
Internet Explorer contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue occurs when the browser does not properly handle requests to the window() object. A remote attacker could create a malicious website that uses an onload event to initialize a window() object, which may cause Internet Explorer to crash or execute arbitrary code with the privileges of the person running it. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Solution: Patch / RCS Exploit: Exploit Public, Exploit Commercial Disclosure: OSVDB Verified |
Solution |
Microsoft has released a patch(MS05-054) to address this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): -Disable Active Scripting |
Products |
|
Credit |
|
gmx.de -