Microsoft cumulative Internet Explorer patch (MS04-038) Drag and Drop Vulnerability

vendor:

Internet Explorer

by:

SecurityFocus

7.5

CVSS

HIGH

Drag and Drop Vulnerability

CWE

Product Name: Internet Explorer

Affected Version From: Internet Explorer 5.01

Affected Version To: Internet Explorer 6.0

Patch Exists: YES

Related CWE: None

CPE: a:microsoft:internet_explorer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2004

Microsoft cumulative Internet Explorer patch (MS04-038) Drag and Drop Vulnerability

The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents.

Mitigation:

Ensure that the latest version of the Microsoft cumulative Internet Explorer patch (MS04-038) is installed.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11466/info

The Microsoft cumulative Internet Explorer patch (MS04-038) attempted to limit what files may be dragged and dropped onto the local computer from the Internet Zone to prevent executable objects from being placed on the file system in this manner. 

However, a number of file types are still permitted for drag and drop operations. It has demonstrated that it is possible to embed hostile HTML and script code in one of these file types, remove the file extension and then allow the operating system to dynamically determine the file type based on its contents.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24693.zip