Vulnerabilities > CVE-2003-0838 - Unspecified vulnerability in Microsoft IE and Internet Explorer
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN microsoft
exploit available
Summary
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 9 |
Exploit-Db
| description | Microsoft Internet Explorer 5/6 Browser Popup Window Object Type Validation Vulnerability. CVE-2003-0838. Remote exploit for windows platform |
| id | EDB-ID:23114 |
| last seen | 2016-02-02 |
| modified | 2003-09-07 |
| published | 2003-09-07 |
| reporter | http-equiv |
| source | https://www.exploit-db.com/download/23114/ |
| title | Microsoft Internet Explorer 5/6 Browser Popup Window Object Type Validation Vulnerability |
Oval
| accepted | 2014-02-24T04:00:27.219-05:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| description | Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe). | ||||||||||||||||||||
| family | windows | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:204 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2003-11-12T05:00:00.000-04:00 | ||||||||||||||||||||
| title | IE ActiveX Popup Zone Restriction Bypass | ||||||||||||||||||||
| version | 68 |
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009639.html
- http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
- http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0310&L=ntbugtraq&F=P&S=&P=2169
- http://www.securityfocus.com/bid/8556
- http://www.osvdb.org/7872
- http://marc.info/?l=bugtraq&m=106304733121753&w=2
- http://marc.info/?l=ntbugtraq&m=106302799428500&w=2
- http://marc.info/?l=bugtraq&m=106304876523459&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13314
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A204
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-040