HTTP: Internet Explorer Drag And Drop
This signature detects Web pages with Web folders pointing to a client-side folder using the shell URI scheme. Attackers can use a malicious Web page containing a client-side Web folder to install arbitrary files in sensitive locations on the client filesystem, such as the startup folder. However, a specially crafted Web site could be using a client-side Web folder legitimately.
Extended Description
The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents. If this issue were combined with other vulnerabilities, such as that described in BID 11467, it may result in execution of arbitrary code on the client computer. Both Internet Explorer and Microsoft Windows itself is affected by this vulnerability.
Affected Products
Microsoft internet_explorer
Short Name
HTTP:STC:IE:DRAG-N-DRP
Severity
Major
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
And CVE-2004-0839 CVE-2005-0053 Drag Drop Explorer Internet bid:10973 bid:11466
Release Date
08/26/2004
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3725
False Positive
Rarely
Vendors
Nortel_networks
Microsoft
CVSS Score
7.5
5.0