CVE-2004-0841 Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" an...
MediumCVSS 5.0
EPSS 48.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya ip600 media servers | All versions | No fix listed |
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp3 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp4 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| avaya definity one media server | All versions | No fix listed |
| avaya s3400 | All versions | No fix listed |
| avaya s8100 | All versions | No fix listed |
| avaya modular messaging message storage server | = 1.1 | No fix listed |
| avaya modular messaging message storage server | = 2.0 | No fix listed |
References
- 20040712 Brand New Hole: Internet Explorer: HijackClick 3 mailing-list
- 12048 third-party-advisory
- 1010679 vdb-entry
- VU#413886 third-party-advisory us-government-resource
- 7774 vdb-entry
- 20040711 HijackClick 3 exploit mailing-list patch vendor-advisory
- 20040712 Re: HijackClick 3 mailing-list
- 10690 exploit patch vdb-entry vendor-advisory
- TA04-293A third-party-advisory us-government-resource
- MS04-038 vendor-advisory
- ie-popupshow-perform-actions(16675) vdb-entry
- oval:org.mitre.oval:def:2611 signature vdb-entry
- oval:org.mitre.oval:def:4363 signature vdb-entry
- oval:org.mitre.oval:def:5620 signature vdb-entry
- oval:org.mitre.oval:def:6031 signature vdb-entry
- oval:org.mitre.oval:def:6048 signature vdb-entry
- oval:org.mitre.oval:def:8077 signature vdb-entry