Microsoft Internet Explorer 4.0.1/5.0/5.0.1 Server-side Redirect File link following

Summaryinfo

A vulnerability marked as critical has been reported in Microsoft Internet Explorer 4.0.1/5.0/5.0.1. Affected is an unknown function of the component Server-side Redirect Handler. The manipulation leads to link following (File). This vulnerability is uniquely identified as CVE-1999-0981. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Internet Explorer 4.0.1/5.0/5.0.1 (Web Browser). It has been rated as critical. This issue affects an unknown code of the component Server-side Redirect Handler. The manipulation with an unknown input leads to a link following vulnerability (File). Using CWE to declare the problem leads to CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Internet Explorer 5.01 and earlier allows a remote attacker to create a reference to a client window and use a server-side redirect to access local files via that window, aka "Server-side Page Reference Redirect."

The issue has been introduced in 11/18/1997. The weakness was disclosed 12/08/1999 as MS99-050 as confirmed bulletin (Technet). It is possible to read the advisory at microsoft.com. The identification of this vulnerability is CVE-1999-0981. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 750 days. During that time the estimated underground price was around $25k-$100k.

Applying the patch MS99-050 is able to eliminate this problem. The bugfix is ready for download at microsoft.com.

The vulnerability is also documented in the databases at X-Force (3663), Exploit-DB (19591) and Vulnerability Center (SBV-4035†). support.microsoft.com is providing further details. The entry VDB-15043 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 4.0.1
• 5.0
• 5.0.1

License

• commercial

Support

• end of life

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion