Vulnerability Details : CVE-2003-0532
Potential exploit
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
Vulnerability category: Execute code
Products affected by CVE-2003-0532
- cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2003-0532
28.46%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2003-0532
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2003-0532
-
http://marc.info/?l=bugtraq&m=106149026621753&w=2
'EEYE: Internet Explorer Object Data Remote Execution Vulnerability' - MARC
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-032
Microsoft Security Bulletin MS03-032 - Critical | Microsoft Learn
-
http://www.eeye.com/html/Research/Advisories/AD20030820.html
-
http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html
Exploit;Vendor Advisory
-
http://www.kb.cert.org/vuls/id/865940
VU#865940 - Microsoft Internet Explorer does not properly evaluate "application/hta" MIME type referenced by DATA attribute of OBJECT elementThird Party Advisory;US Government Resource
Jump to