Description
Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing the control.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Internet Explorer 5.0.1 - Modal Dialog Manipulation EDB-27744 · remote · Apr 26, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2006-1559 vdb-entry
- 20060426 Internet Explorer User Interface Races, Redeux mailing-list
- 17713 vdb-entry
- 1015720 vdb-entry
- 22351 vdb-entry
- http://student.missouristate.edu/m/matthew007/advisories.asp?adv=2006-02
- 20060427 PoC for Internet Explorer Modal Dialog Issue mailing-list
- ie-modal-dialog-code-execution(26111) vdb-entry
- 20060427 PoC for Internet Explorer Modal Dialog Issue mailing-list
- http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/
- 20040407 Race conditions in security dialogs mailing-list