Microsoft Internet Explorer 4.0/4.0.1/5.0 ActiveX Control CAB File privileges management

Summaryinfo

A vulnerability was found in Microsoft Internet Explorer 4.0/4.0.1/5.0. It has been declared as critical. Affected by this issue is some unknown functionality of the component ActiveX Control Handler. Such manipulation as part of CAB File leads to privileges management. This vulnerability is uniquely identified as CVE-2000-0329. The attack can be launched remotely. Moreover, an exploit is present. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft Internet Explorer 4.0/4.0.1/5.0 (Web Browser) and classified as critical. Affected by this issue is some unknown processing of the component ActiveX Control Handler. The manipulation as part of a CAB File leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control" vulnerability.

The issue has been introduced in 04/01/1997. The weakness was disclosed 11/11/1999 as MS99-048 as confirmed bulletin (Technet). The advisory is shared for download at microsoft.com. This vulnerability is handled as CVE-2000-0329. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 954 days. During that time the estimated underground price was around $25k-$100k.

Upgrading to version 6 eliminates this vulnerability. Applying the patch MS99-048 is able to eliminate this problem. The bugfix is ready for download at microsoft.com. The best possible mitigation is suggested to be patching the affected component.

The vulnerability is also documented in the databases at X-Force (3494), Exploit-DB (19603) and Vulnerability Center (SBV-4223†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 4.0
• 4.0.1
• 5.0

License

• commercial

Support

• end of life

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion