CVE-2003-1026 Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window...
HighCVSS 9.3
EPSS 39.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0 | No fix listed |
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp3 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20031125 BackToFramedJpu - a successor of BackToJpu attack mailing-list
- 20031201 Comments on 5 IE vulnerabilities mailing-list
- VU#784102 third-party-advisory us-government-resource
- www.safecenter.net
- TA04-033A third-party-advisory us-government-resource
- MS04-004 vendor-advisory
- ie-subframe-xss(13846) vdb-entry
- oval:org.mitre.oval:def:630 signature vdb-entry
- oval:org.mitre.oval:def:643 signature vdb-entry
- oval:org.mitre.oval:def:687 signature vdb-entry
- oval:org.mitre.oval:def:689 signature vdb-entry
- oval:org.mitre.oval:def:745 signature vdb-entry
- oval:org.mitre.oval:def:774 signature vdb-entry
- oval:org.mitre.oval:def:805 signature vdb-entry