CVE-2003-1027 Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.mov...
HighCVSS 10.0
EPSS 38.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0 | No fix listed |
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp3 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20031125 HijackClickV2 - a successor of HijackClick attack mailing-list
- 20031201 Comments on 5 IE vulnerabilities mailing-list
- VU#413886 third-party-advisory us-government-resource
- www.safecenter.net
- 1006036 vdb-entry
- TA04-033A third-party-advisory us-government-resource
- MS04-004 vendor-advisory
- ie-method-perform-actions(13844) vdb-entry
- oval:org.mitre.oval:def:527 signature vdb-entry
- oval:org.mitre.oval:def:529 signature vdb-entry
- oval:org.mitre.oval:def:530 signature vdb-entry
- oval:org.mitre.oval:def:531 signature vdb-entry
- oval:org.mitre.oval:def:532 signature vdb-entry
- oval:org.mitre.oval:def:534 signature vdb-entry
- oval:org.mitre.oval:def:629 signature vdb-entry