Description
The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008.
References
- 7890 vdb-entry
- 20031201 Comments on 5 IE vulnerabilities mailing-list
- ie-download-directory-disclosure(13847) vdb-entry
- 20031125 Note for "Invalid ContentType may disclose cache directory" mailing-list
- http://www.safecenter.net/UMBRELLAWEBV4/threadid10008
- 20031125 Invalid ContentType may disclose cache directory mailing-list