CVE-2004-0549
EXPLOITEDInternet Explorer 6 - Remote Code Execution via showModalDialog Location Manipulation
Title source: llmExploitation Summary
CVE-2004-0549 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Ferruh Mavituna.
AI-analyzed exploit summary This exploit leverages a vulnerability in Internet Explorer (CVE-2004-0549) to execute arbitrary code via a crafted HTML page. It uses a combination of JavaScript, VBScript, and ActiveX to download and execute a malicious payload (bad.exe) from a remote share.
Description
The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.
Exploits (1)
This exploit leverages a vulnerability in Internet Explorer (CVE-2004-0549) to execute arbitrary code via a crafted HTML page. It uses a combination of JavaScript, VBScript, and ActiveX to download and execute a malicious payload (bad.exe) from a remote share.