Description
Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Internet Explorer 5.0.1 - JavaScript Method Assignment Cross-Domain Scripting EDB-24265 · remote · Jul 12, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://freehost07.websamba.com/greyhats/similarmethodnameredir.htm
- oval:org.mitre.oval:def:7448 vdb-entry signature
- oval:org.mitre.oval:def:7496 vdb-entry signature
- VU#207264 third-party-advisory
- MS04-038 vendor-advisory
- oval:org.mitre.oval:def:4702 vdb-entry signature
- oval:org.mitre.oval:def:7906 vdb-entry signature
- 12048 third-party-advisory
- TA04-293A third-party-advisory
- ie-function-redirect-xss(16681) vdb-entry
- oval:org.mitre.oval:def:6829 vdb-entry signature
- 20040711 MSIE Similar Method Name Redirection Cross Site/Zone Scripting mailing-list
- oval:org.mitre.oval:def:7084 vdb-entry signature