Description
Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Internet Explorer 6 - IFRAME Tag Buffer Overflow EDB-612 · remote · Nov 2, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VU#842160 third-party-advisory
- 20041023 python does mangleme (with IE bugs!) mailing-list
- MS04-040 vendor-advisory
- 20041102 MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC mailing-list
- 11515 vdb-entry
- oval:org.mitre.oval:def:1294 vdb-entry signature
- 20041025 python does mangleme (with IE bugs!) mailing-list
- TA04-315A third-party-advisory
- ie-iframe-src-name-bo(17889) vdb-entry
- 12959 third-party-advisory
- 20041024 python does mangleme (with IE bugs!) mailing-list
- TA04-336A third-party-advisory