HTTP: Internet Explorer Windows Scripting Host Object Vulnerability

This signature detects attempts to exploit a known vulnerability in Microsoft Internet Explorer (IE). Attackers can create a malicious Web page that misuses a Windows Scripting Host class ID within an Object Tag. When the Web page is viewed, the Object Tag can give the attacker complete control over the viewer's host computer. Spyware and spam organizations are actively using this exploit to install programs on end-user computers.

Extended Description

The problem occurs when Internet Explorer receives a response from the server when a web page containing an object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be executed on the local system. All code execution would occur in the security context of the current user.

Affected Products

Microsoft internet_explorer

References

BugTraq: 8456

CVE: CVE-2003-0532

URL: http://www.kb.cert.org/vuls/id/865940 http://www.microsoft.com/technet/security/bulletin/MS03-032.asp

Short Name

HTTP:STC:CLSID:ACTIVEX:WSH

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Internet Explorer Windows Scripting Host Object Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?