A vulnerability, which was classified as critical, was found in Microsoft Internet Explorer up to 6 (Web Browser). Affected is the function WsFakeSrc. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 09/11/2003 by Liu Die Yu as not defined posting (Bugtraq). The advisory is available at securityfocus.com. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The exploit is shared for download at safecenter.net. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k.

Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at windowsupdate.microsoft.com. The best possible mitigation is suggested to be upgrading to the latest version.

Further details are available at kryptocrew.de. The entries 280, 281, 283 and 284 are pretty similar.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 4
• 5
• 6

License

• commercial

Support

• end of life

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion