Description
The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/7890
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=107038202225587&w=2
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/13847
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=106979428718705&w=2
Various Sources x_refsource_misc
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=106979624321665&w=2
Scores
EPSS
0.1905
EPSS Percentile
97.0%
Details
Status
published
Products (5)
microsoft/ie
6.0 sp1
microsoft/internet_explorer
5.0
microsoft/internet_explorer
5.0.1 (4 CPE variants)
microsoft/internet_explorer
5.5 (3 CPE variants)
microsoft/internet_explorer
6.0
Published
Jan 20, 2004
Tracked Since
Feb 18, 2026