CVE-2004-1050

Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability."

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html
http://marc.info/?l=bugtraq&m=109942758911846&w=2
http://secunia.com/advisories/12959/
http://www.kb.cert.org/vuls/id/842160	Third Party Advisory US Government Resource
http://www.securityfocus.com/archive/1/379261
http://www.securityfocus.com/bid/11515
http://www.us-cert.gov/cas/techalerts/TA04-315A.html	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA04-336A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-040
https://exchange.xforce.ibmcloud.com/vulnerabilities/17889
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1294
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html
http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html
http://marc.info/?l=bugtraq&m=109942758911846&w=2
http://secunia.com/advisories/12959/
http://www.kb.cert.org/vuls/id/842160	Third Party Advisory US Government Resource
http://www.securityfocus.com/archive/1/379261
http://www.securityfocus.com/bid/11515
http://www.us-cert.gov/cas/techalerts/TA04-315A.html	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA04-336A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-040
https://exchange.xforce.ibmcloud.com/vulnerabilities/17889
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1294

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:avaya:ip600_media_servers::::::::
	cpe:2.3:a:avaya:ip600_media_servers:r6:::::::*
	cpe:2.3:a:avaya:ip600_media_servers:r7:::::::*
	cpe:2.3:a:avaya:ip600_media_servers:r8:::::::*
	cpe:2.3:a:avaya:ip600_media_servers:r9:::::::*
	cpe:2.3:a:avaya:ip600_media_servers:r10:::::::*
	cpe:2.3:a:avaya:ip600_media_servers:r11:::::::*
	cpe:2.3:a:avaya:ip600_media_servers:r12:::::::*
	cpe:2.3:a:microsoft:ie:6.0:sp1::::::
	cpe:2.3:a:microsoft:internet_explorer:6.0:::::::*
	cpe:2.3:h:avaya:definity_one_media_server::::::::
	cpe:2.3:h:avaya:definity_one_media_server:r6:::::::*
	cpe:2.3:h:avaya:definity_one_media_server:r7:::::::*
	cpe:2.3:h:avaya:definity_one_media_server:r8:::::::*
	cpe:2.3:h:avaya:definity_one_media_server:r9:::::::*
	cpe:2.3:h:avaya:definity_one_media_server:r10:::::::*
	cpe:2.3:h:avaya:definity_one_media_server:r11:::::::*
	cpe:2.3:h:avaya:definity_one_media_server:r12:::::::*
	cpe:2.3:h:avaya:s3400::::::::
	cpe:2.3:h:avaya:s8100::::::::
	cpe:2.3:h:avaya:s8100:r6:::::::*
	cpe:2.3:h:avaya:s8100:r7:::::::*
	cpe:2.3:h:avaya:s8100:r8:::::::*
	cpe:2.3:h:avaya:s8100:r9:::::::*
	cpe:2.3:h:avaya:s8100:r10:::::::*
	cpe:2.3:h:avaya:s8100:r11:::::::*
	cpe:2.3:h:avaya:s8100:r12:::::::*

Configuration 2 (hide)

cpe:2.3:o:avaya:modular_messaging_message_storage_server:s3400:*:*:*:*:*:*:*

History

20 Nov 2024, 23:49

Type	Values Removed	Values Added
References	~~() http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html -~~	() http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html -
References	~~() http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html -~~	() http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html -
References	~~() http://marc.info/?l=bugtraq&m=109942758911846&w=2 -~~	() http://marc.info/?l=bugtraq&m=109942758911846&w=2 -
References	~~() http://secunia.com/advisories/12959/ -~~	() http://secunia.com/advisories/12959/ -
References	~~() http://www.kb.cert.org/vuls/id/842160 - Third Party Advisory, US Government Resource~~	() http://www.kb.cert.org/vuls/id/842160 - Third Party Advisory, US Government Resource
References	~~() http://www.securityfocus.com/archive/1/379261 -~~	() http://www.securityfocus.com/archive/1/379261 -
References	~~() http://www.securityfocus.com/bid/11515 -~~	() http://www.securityfocus.com/bid/11515 -
References	~~() http://www.us-cert.gov/cas/techalerts/TA04-315A.html - US Government Resource~~	() http://www.us-cert.gov/cas/techalerts/TA04-315A.html - US Government Resource
References	~~() http://www.us-cert.gov/cas/techalerts/TA04-336A.html - US Government Resource~~	() http://www.us-cert.gov/cas/techalerts/TA04-336A.html - US Government Resource
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-040 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-040 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/17889 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/17889 -
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1294 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1294 -

Information

Published : 2004-12-31 05:00

Updated : 2025-04-03 01:03

NVD link : CVE-2004-1050

Mitre link : CVE-2004-1050

CVE.ORG link : CVE-2004-1050

JSON object : View

Products Affected

avaya

ip600_media_servers
s3400
definity_one_media_server
s8100
modular_messaging_message_storage_server

microsoft

ie
internet_explorer

CWE

NVD-CWE-Other

{"id": "CVE-2004-1050", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html", "source": "cve@mitre.org"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=109942758911846&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/12959/", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/842160", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/379261", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/11515", "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA04-315A.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA04-336A.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-040", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17889", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1294", "source": "cve@mitre.org"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028009.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/028035.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://marc.info/?l=bugtraq&m=109942758911846&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/12959/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/842160", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/379261", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/11515", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA04-315A.html", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA04-336A.html", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-040", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17889", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1294", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka \"the IFRAME vulnerability\" or the \"HTML Elements Vulnerability.\""}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:avaya:ip600_media_servers:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9692F8E9-E8E9-43A8-87D5-F2409333F8CC"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "421DCFC1-D1DF-4081-96C1-A1FA69632B40"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AB4E5D4-712A-4F8B-9571-23C5841FE653"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B61857E-9B4A-480B-8381-4C1213063D8E"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9AF988E-D84B-4F47-BBF6-E08C6615E838"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74D156F2-E2BD-4E72-9776-21BCC3B3EC3A"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC8CC2A7-E209-45FC-B4F7-83FAD79E2452"}, {"criteria": "cpe:2.3:a:avaya:ip600_media_servers:r12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18CBDA7C-1E0E-470C-A740-807C559FBA43"}, {"criteria": "cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24DF2AB3-DEAB-4D70-986E-FFBB7E64B96A"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A19F6133-25D1-44A5-B6B9-354703436783"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88301496-BED2-45EB-BF19-5F5BF2957373"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EB98D81-7F43-46BD-9713-C1036F123ECF"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F71B32E1-650F-48F6-B04A-F54B5CB12FFF"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C7A48D2-7CDB-40DE-95C0-EDF6CDDF7A80"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F67BC930-C6D3-40FC-A44F-49A3A6E9B016"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6469B5B2-9939-4163-A6C9-CC50D3358401"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCB9EF69-E099-4908-AC09-EE2811E39F55"}, {"criteria": "cpe:2.3:h:avaya:definity_one_media_server:r12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3129813-C6BA-48B1-944B-D34D7A0F0F21"}, {"criteria": "cpe:2.3:h:avaya:s3400:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCB0BA4C-BA48-4DDA-917E-9EA9E04A898F"}, {"criteria": "cpe:2.3:h:avaya:s8100:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D190CA6-7807-4361-8FB8-C015B21E66B1"}, {"criteria": "cpe:2.3:h:avaya:s8100:r6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F28E0D07-ED87-44D0-A771-FB5C9D5CA32E"}, {"criteria": "cpe:2.3:h:avaya:s8100:r7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F01F490-DA2A-4C89-9C9A-1B2B1CFF8849"}, {"criteria": "cpe:2.3:h:avaya:s8100:r8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F867CCDD-DDAC-4802-8AE3-9CEDB7F0FDF3"}, {"criteria": "cpe:2.3:h:avaya:s8100:r9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD501EF0-7531-47DD-A4A8-1F3790401A55"}, {"criteria": "cpe:2.3:h:avaya:s8100:r10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DC0D2D7-B6E2-40D3-8830-E0AF518253E7"}, {"criteria": "cpe:2.3:h:avaya:s8100:r11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "436EF2B4-B365-4307-B345-24527D7B5909"}, {"criteria": "cpe:2.3:h:avaya:s8100:r12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1562F7ED-5821-43AA-92CE-9BD7E67A47F8"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:avaya:modular_messaging_message_storage_server:s3400:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BFF29C7-E5AA-44EB-B1A9-602B3692D893"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

10.0 /10