News
Vigil@nce: Internet Explorer, code execution when printing
May 2008 by Vigil@nce
An attacker can invite the victim to print the table of links in
order to execute code on his computer.
Gravity: 1/4
CVSS: 7.5/10
Consequences: user access/rights
Provenance: internet server
Means of attack: 1 proof of concept
Ability of attacker: specialist (3/4)
Confidence: unique source (2/5)
Diffusion of the vulnerable configuration: low (1/3)
Creation date: 14/05/2008
Identifier: VIGILANCE-VUL-7829
AFFECTED PRODUCTS
– Microsoft Internet Explorer versions 7 sous WinXP_SP1, 7 sous
WinXP_SP2, 7 sous WinXP_SP3, 7 sous Win2003, 7 sous Win2003_SP1, 7 sous Win2003_SP2, 7 sous WinVista, 7 sous WinVista_SP1, 7 sous
Win2008
Similar products or versions inferior to those indicated may also
be affected.
DESCRIPTION
The Option tab of the print dialog of Internet Explorer contains
the "Print table of links" checkbox. This checkbox is unchecked by
default. When it is checked, Internet Explorer generates a new
HTML page containing the list of links contained in the document.
However, links extracted from the document are not filtered before
being inserted in the table. Moreover, this document is printed in
the local zone.
An attacker can therefore create a web document whose links are
scripts, then invite the victim to print this document. When the
page to print is generated, attacker’s script is run in the local
zone.
An attacker can thus invite the victim to print the table of links
in order to execute code on his computer.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-7829
CVSS score: 7.5/10
https://vigilance.aql.fr/tree/1/7829
