HTTP: Internet Explorer Drag-and-Drop Modified

This signature detects attempts to exploit a known vulnerability against Internet Explorer. By sending an updated attack vector for the drag and drop vulnerability, a malicious attacker can upload arbitrary executables to the startup folder and compromise a host by tricking a user into viewing a malicious Web-site.

Extended Description

The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents. If this issue were combined with other vulnerabilities, such as that described in BID 11467, it may result in execution of arbitrary code on the client computer. Both Internet Explorer and Microsoft Windows itself is affected by this vulnerability.

Affected Products

Microsoft internet_explorer

References

BugTraq: 11466

CVE: CVE-2005-0053

URL: http://www.kb.cert.org/vuls/id/939688 http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx

Short Name

HTTP:STC:IE:DRAG-DROP-MOD

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Internet Explorer Drag-and-Drop Modified

Extended Description

Affected Products

References

Found a potential security threat?