CVE-2003-1328 The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execut...
HighCVSS 7.5
EPSS 38.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp3 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20030206 showHelp("file:") disables security in IE - Sandblad advisory #11 mailing-list
- N-038 government-resource third-party-advisory
- ie-showhelp-zone-bypass(11259) vdb-entry vendor-advisory
- VU#400577 third-party-advisory us-government-resource
- 6780 vdb-entry
- MS03-004 vendor-advisory
- oval:org.mitre.oval:def:57 signature vdb-entry