Vulnerability Name:

CVE-2001-0664 (CCN-7258)

Assigned:2001-10-10
Published:2001-10-10
Updated:2021-07-23
Summary:Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing vulnerability."
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Bypass Security
References:Source: CCN
Type: BugTraq Mailing List, Thu Oct 11 2001 - 04:37:48 CDT
Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing

Source: MITRE
Type: CNA
CVE-2001-0664

Source: BUGTRAQ
Type: UNKNOWN
20011011 Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing

Source: MISC
Type: UNKNOWN
http://morph3us.org/blog/?p=31

Source: CCN
Type: Microsoft Security Bulletin MS01-051
Malformed Dotless IP Address Can Cause Web Page to be Handled in Intranet Zone

Source: CCN
Type: Microsoft Security Bulletin MS01-055
13 November 2001 Cumulative Patch for IE

Source: CCN
Type: Microsoft Security Bulletin MS01-058
13 December 2001 Cumulative Patch for IE

Source: CCN
Type: Microsoft Security Bulletin MS02-005
11 February 2002 Cumulative Patch for Internet Explorer

Source: CCN
Type: Microsoft Security Bulletin MS02-015
28 March 2002 Cumulative Patch for Internet Explorer

Source: CCN
Type: Microsoft Security Bulletin MS02-023
15 May 2002 Cumulative Patch for Internet Explorer (Q321232)

Source: CCN
Type: Microsoft Security Bulletin MS02-047
Cumulative Patch for Internet Explorer (Q323759)

Source: CCN
Type: Microsoft Security Bulletin MS02-066
Cumulative Patch for Internet Explorer (Q328970)

Source: CCN
Type: Microsoft Security Bulletin MS02-068
Cumulative Patch for Internet Explorer (324929)

Source: CCN
Type: Microsoft Security Bulletin MS03-004
Cumulative Patch for Internet Explorer (810847)

Source: CCN
Type: Microsoft Security Bulletin MS03-015
Cumulative Patch for Internet Explorer (813489)

Source: CCN
Type: Microsoft Security Bulletin MS03-020
Cumulative Patch for Internet Explorer (818529)

Source: CCN
Type: Microsoft Security Bulletin MS03-032
Cumulative Patch for Internet Explorer (822925)

Source: CCN
Type: Microsoft Security Bulletin MS03-040
Cumulative Patch for Internet Explorer (828750)

Source: CCN
Type: Microsoft Security Bulletin MS03-048
Cumulative Security Update for Internet Explorer (824145)

Source: CCN
Type: Microsoft Security Bulletin MS04-004
Cumulative Security Update for Internet Explorer (832894)

Source: CCN
Type: Microsoft Security Bulletin MS04-025
Cumulative Security Update for Internet Explorer (867801)

Source: CCN
Type: Microsoft Security Bulletin MS04-038
Cumulative Security Update for Internet Explorer (834707)

Source: CCN
Type: Microsoft Security Bulletin MS04-040
Cumulative Security Update for Internet Explorer (889293)

Source: CCN
Type: Microsoft Security Bulletin MS05-014
Cumulative Security Update for Internet Explorer (867282)

Source: CCN
Type: Microsoft Security Bulletin MS05-020
Cumulative Security Update for Internet Explorer (890923)

Source: CCN
Type: Microsoft Security Bulletin MS05-025
Cumulative Security Update for Internet Explorer (883939)

Source: CCN
Type: Microsoft Security Bulletin MS05-038
Cumulative Security Update for Internet Explorer (896727)

Source: CCN
Type: Microsoft Security Bulletin MS05-052
Cumulative Security Update for Internet Explorer (896688)

Source: CCN
Type: Microsoft Security Bulletin MS05-054
Cumulative Security Update for Internet Explorer (905915)

Source: CCN
Type: Microsoft Security Bulletin MS06-004
Cumulative Security Update for Internet Explorer (910620)

Source: CCN
Type: Microsoft Security Bulletin MS06-013
Cumulative Security Update for Internet Explorer (912812)

Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)

Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)

Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)

Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)

Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)

Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)

Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)

Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)

Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)

Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)

Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)

Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)

Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)

Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)

Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)

Source: OSVDB
Type: UNKNOWN
1971

Source: CCN
Type: OSVDB ID: 1971
Microsoft IE Dotless IP Zone Spoofing

Source: BID
Type: UNKNOWN
3420

Source: CCN
Type: BID-3420
Microsoft Internet Explorer Zone Spoofing Vulnerability

Source: MS
Type: UNKNOWN
MS01-051

Source: XF
Type: UNKNOWN
ie-incorrect-security-zone(7258)

Source: XF
Type: UNKNOWN
ie-incorrect-security-zone(7258)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    microsoft internet explorer 5.01
    microsoft internet explorer 5.5
    microsoft ie 5.01
    microsoft ie 5.5
    microsoft ie 6.0