Launichng programs via OBJECT tag and scripting via cookies in Microsoft Internet Explorer updated since 17.01.2002
Published:		22.02.2003
Source:		BUGTRAQ
SecurityVulns ID:		1698
Type:		client
Level:		7/10
Description:		It's possible to launch any installed application using OBJECT tag

Affected:		MICROSOFT : Internet Explorer 5.5
		MICROSOFT : Internet Explorer 6.0

Original document		http-equiv_(at)_excite.com, O UT LO OK E XPRE SS 6 .00 : broken (22.02.2003)
		Andreas Sandblad, Using the backbutton in IE is dangerous (15.04.2002)
		Elia Florio, Outlook Express Attach Execution Exploit (img tag + innerHTML + TIF dos name) (03.04.2002)
		MICROSOFT, Security Bulletin MS02-015 (29.03.2002)
		GreyMagic Software, IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) (28.02.2002)
		the Pull, Internet Explorer Pop-Up OBJECT Tag Bug (17.01.2002)
		the Pull, Addendum Re: Internet Explorer Pop-Up OBJECT Tag Bug (17.01.2002)

Discuss:

Read or add your comments to this news (0 comments)