Microsoft Internet Explorer 5.01/5.5 Frame privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in Microsoft Internet Explorer 5.01/5.5. Affected is an unknown function of the component Frame Handler. The manipulation leads to privileges management. This vulnerability is traded as CVE-2001-0246. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Internet Explorer 5.01/5.5 (Web Browser). It has been rated as critical. This issue affects an unknown functionality of the component Frame Handler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality. The summary by CVE is:

Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site operators to read certain files on the client by sending information from a local frame to a frame in a different domain, aka a variant of the "Frame Domain Verification" vulnerability.

The issue has been introduced in 11/08/1999. The weakness was shared 06/27/2001 as MS01-027 as confirmed bulletin (Technet). The advisory is shared at microsoft.com. The identification of this vulnerability is CVE-2001-0246. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 597 days. During that time the estimated underground price was around $25k-$100k.

Applying the patch MS01-027 is able to eliminate this problem. The bugfix is ready for download at microsoft.com.

The vulnerability is also documented in the vulnerability database at Vulnerability Center (SBV-2406†). The entries VDB-16834, VDB-16840 and VDB-16841 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 5.01
• 5.5

License

• commercial

Support

• end of life

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion