Description
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."
References
- oval:org.mitre.oval:def:527 vdb-entry signature
- VU#413886 third-party-advisory
- oval:org.mitre.oval:def:629 vdb-entry signature
- oval:org.mitre.oval:def:531 vdb-entry signature
- http://www.safecenter.net/UMBRELLAWEBV4/HijackClickV2
- oval:org.mitre.oval:def:530 vdb-entry signature
- 20031201 Comments on 5 IE vulnerabilities mailing-list
- TA04-033A third-party-advisory
- MS04-004 vendor-advisory
- oval:org.mitre.oval:def:532 vdb-entry signature
- oval:org.mitre.oval:def:534 vdb-entry signature
- 20031125 HijackClickV2 - a successor of HijackClick attack mailing-list
- ie-method-perform-actions(13844) vdb-entry
- oval:org.mitre.oval:def:529 vdb-entry signature
- 1006036 vdb-entry