CVE-2005-3240 : Race condition in Microsoft Internet Explorer allows user-assisted attackers to

Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects, such as file objects within a folder view, then predicting the drag action, and re-focusing to a malicious window.

Published 2005-12-31 05:00:00

Updated 2021-07-23 12:55:04

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2005-3240

Microsoft » IE » Version: 6.0 Update SP1
cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.01 Update SP3
cpe:2.3:a:microsoft:internet_explorer:5.01:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.01 Update SP4
cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.5 Update SP2
cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.01
cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 6.0
cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.5
cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.01 Update SP1
cpe:2.3:a:microsoft:internet_explorer:5.01:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.01 Update SP2
cpe:2.3:a:microsoft:internet_explorer:5.01:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 5.5 Update SP1
cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2005-3240

EPSS FAQ

8.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 94 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2005-3240

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2005-3240

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2005-3240

Jump to

Vulnerability Details : CVE-2005-3240

Products affected by CVE-2005-3240

Exploit prediction scoring system (EPSS) score for CVE-2005-3240

CVSS scores for CVE-2005-3240

CWE ids for CVE-2005-3240

References for CVE-2005-3240