Vulnerability Name:

CVE-2003-0815 (CCN-13676)

Assigned:2003-11-11
Published:2003-11-11
Updated:2021-07-23
Summary:Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2003-0815

Source: BUGTRAQ
Type: UNKNOWN
20030910 MSIE->LinkillerJPU:another caller-based authorization(is broken).

Source: BUGTRAQ
Type: UNKNOWN
20030910 MSIE->Findeath: break caller-based authorization

Source: CCN
Type: SA10192
Microsoft Internet Explorer Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
10192

Source: CCN
Type: SECTRACK ID: 1007687
Microsoft Internet Explorer Various Cross-Domain Flaws Permit Remote Scripting in Arbitrary Domains

Source: SECTRACK
Type: UNKNOWN
1007687

Source: CCN
Type: CIAC Information Bulletin O-021
Microsoft Cumulative Security Update for Internet Explorer

Source: CIAC
Type: UNKNOWN
O-021

Source: BUGTRAQ
Type: UNKNOWN
20030910 MSIE->LinkillerSaveRef:another caller-based authorization

Source: CCN
Type: Microsoft Security Bulletin MS03-048
Cumulative Security Update for Internet Explorer (824145)

Source: CCN
Type: Microsoft Security Bulletin MS04-004
Cumulative Security Update for Internet Explorer (832894)

Source: CCN
Type: Microsoft Security Bulletin MS04-025
Cumulative Security Update for Internet Explorer (867801)

Source: CCN
Type: Microsoft Security Bulletin MS04-038
Cumulative Security Update for Internet Explorer (834707)

Source: CCN
Type: Microsoft Security Bulletin MS04-040
Cumulative Security Update for Internet Explorer (889293)

Source: CCN
Type: Microsoft Security Bulletin MS05-014
Cumulative Security Update for Internet Explorer (867282)

Source: CCN
Type: Microsoft Security Bulletin MS05-020
Cumulative Security Update for Internet Explorer (890923)

Source: CCN
Type: Microsoft Security Bulletin MS05-025
Cumulative Security Update for Internet Explorer (883939)

Source: CCN
Type: Microsoft Security Bulletin MS05-038
Cumulative Security Update for Internet Explorer (896727)

Source: CCN
Type: Microsoft Security Bulletin MS05-052
Cumulative Security Update for Internet Explorer (896688)

Source: CCN
Type: Microsoft Security Bulletin MS05-054
Cumulative Security Update for Internet Explorer (905915)

Source: CCN
Type: Microsoft Security Bulletin MS06-004
Cumulative Security Update for Internet Explorer (910620)

Source: CCN
Type: Microsoft Security Bulletin MS06-013
Cumulative Security Update for Internet Explorer (912812)

Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)

Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)

Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)

Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)

Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)

Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)

Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)

Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)

Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)

Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)

Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)

Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)

Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)

Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)

Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)

Source: OSVDB
Type: UNKNOWN
7888

Source: OSVDB
Type: UNKNOWN
7889

Source: CCN
Type: OSVDB ID: 7888
Microsoft IE createRange FIND Dialog Security Bypass (Findeath)

Source: CCN
Type: OSVDB ID: 7889
Microsoft IE createTextRange Security Bypass (LinKiller)

Source: MISC
Type: UNKNOWN
http://www.safecenter.net/UMBRELLAWEBV4/Linkiller/Linkiller-Content.HTM

Source: MISC
Type: UNKNOWN
http://www.safecenter.net/UMBRELLAWEBV4/LinkillerJPU/LinkillerJPU-Content.HTM

Source: MISC
Type: UNKNOWN
http://www.safecenter.net/UMBRELLAWEBV4/LinkillerSaveRef/LinkillerSaveRef-Content.HTM

Source: BUGTRAQ
Type: UNKNOWN
20030911 LiuDieYu's missing files are here.

Source: BID
Type: Patch, Vendor Advisory
9014

Source: CCN
Type: BID-9014
Microsoft Internet Explorer Function Pointer Override Cross-Domain Access Violation Vulnerability

Source: MS
Type: UNKNOWN
MS03-048

Source: XF
Type: UNKNOWN
ie-pointer-zone-bypass(13676)

Source: XF
Type: UNKNOWN
ie-pointer-zone-bypass(13676)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:351

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:352

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:353

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:356

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:357

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:359

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:472

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:351
    V
    		IE v5.01,SP2 Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:357
    V
    		IE v6.0,SP1 Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:352
    V
    		IE v5.01,SP3 Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:359
    V
    		IE v6.0,SP1 (Server 2003) Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:353
    V
    		IE v5.01,SP4 Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:472
    V
    		IE v6.0 (XP) Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:356
    V
    		IE v5.5,SP2 Function Pointer Override Cross Domain Vulnerability
    2014-02-24
    BACK
    microsoft internet explorer 5.5 sp1
    microsoft internet explorer 5.5 sp2
    microsoft internet explorer 5.0.1 sp1
    microsoft internet explorer 5.0.1 sp2
    microsoft internet explorer 5.0.1
    microsoft internet explorer 6.0
    microsoft ie 6.0 sp1
    microsoft internet explorer 5.0.1 sp3
    microsoft internet explorer 5.5
    microsoft ie 5.01
    microsoft ie 5.5
    microsoft ie 6.0