Vulnerabilities > CVE-2003-0838 - Unspecified vulnerability in Microsoft IE and Internet Explorer

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
microsoft
exploit available
NVD
Published: 2003-11-17
Updated: 2021-07-23

Summary

Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).

Vulnerable Configurations

Part Description Count
Application
Microsoft
9

Exploit-Db

descriptionMicrosoft Internet Explorer 5/6 Browser Popup Window Object Type Validation Vulnerability. CVE-2003-0838. Remote exploit for windows platform
idEDB-ID:23114
last seen2016-02-02
modified2003-09-07
published2003-09-07
reporterhttp-equiv
sourcehttps://www.exploit-db.com/download/23114/
titleMicrosoft Internet Explorer 5/6 Browser Popup Window Object Type Validation Vulnerability

Oval

accepted2014-02-24T04:00:27.219-05:00
classvulnerability
contributors
  • nameTiffany Bergeron
    organizationThe MITRE Corporation
  • nameAndrew Buttner
    organizationThe MITRE Corporation
  • nameChristine Walzer
    organizationThe MITRE Corporation
  • nameRobert L. Hollis
    organizationThreatGuard, Inc.
  • nameMaria Mikhno
    organizationALTX-SOFT
descriptionInternet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
familywindows
idoval:org.mitre.oval:def:204
statusaccepted
submitted2003-11-12T05:00:00.000-04:00
titleIE ActiveX Popup Zone Restriction Bypass
version68

References