CVE-2004-1050 Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discover...
HighCVSS 10.0
EPSS 67.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya ip600 media servers | All versions | No fix listed |
| avaya ip600 media servers | = r6 | No fix listed |
| avaya ip600 media servers | = r7 | No fix listed |
| avaya ip600 media servers | = r8 | No fix listed |
| avaya ip600 media servers | = r9 | No fix listed |
| avaya ip600 media servers | = r10 | No fix listed |
| avaya ip600 media servers | = r11 | No fix listed |
| avaya ip600 media servers | = r12 | No fix listed |
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| avaya definity one media server | All versions | No fix listed |
| avaya definity one media server | = r6 | No fix listed |
| avaya definity one media server | = r7 | No fix listed |
| avaya definity one media server | = r8 | No fix listed |
| avaya definity one media server | = r9 | No fix listed |
| avaya definity one media server | = r10 | No fix listed |
| avaya definity one media server | = r11 | No fix listed |
| avaya definity one media server | = r12 | No fix listed |
| avaya s3400 | All versions | No fix listed |
| avaya s8100 | All versions | No fix listed |
| avaya s8100 | = r6 | No fix listed |
| avaya s8100 | = r7 | No fix listed |
| avaya s8100 | = r8 | No fix listed |
| avaya s8100 | = r9 | No fix listed |
| avaya s8100 | = r10 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya s8100 | = r11 | No fix listed |
| avaya s8100 | = r12 | No fix listed |
| avaya modular messaging message storage server | = s3400 | No fix listed |
References
- 20041023 python does mangleme (with IE bugs!) mailing-list
- 20041025 python does mangleme (with IE bugs!) mailing-list
- 20041102 MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC mailing-list
- 12959 third-party-advisory
- VU#842160 third-party-advisory us-government-resource
- 20041024 python does mangleme (with IE bugs!) mailing-list
- 11515 vdb-entry
- TA04-315A third-party-advisory us-government-resource
- TA04-336A third-party-advisory us-government-resource
- MS04-040 vendor-advisory
- ie-iframe-src-name-bo(17889) vdb-entry
- oval:org.mitre.oval:def:1294 signature vdb-entry