Vulnerability Name:

CVE-2004-0843 (CCN-17655)

Assigned:2004-10-12
Published:2004-10-12
Updated:2021-07-23
Summary:Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2004-0843

Source: CCN
Type: CIAC Information Bulletin P-006
Microsoft Cumulative Security Update for Internet Explorer (834707)

Source: CCN
Type: US-CERT VU#625616
Microsoft Internet Explorer does not properly handle navigations from plug-ins

Source: CERT-VN
Type: Patch, Third Party Advisory, US Government Resource
VU#625616

Source: CCN
Type: Microsoft Security Bulletin MS04-038
Cumulative Security Update for Internet Explorer (834707)

Source: CCN
Type: Microsoft Security Bulletin MS04-040
Cumulative Security Update for Internet Explorer (889293)

Source: CCN
Type: Microsoft Security Bulletin MS05-014
Cumulative Security Update for Internet Explorer (867282)

Source: CCN
Type: Microsoft Security Bulletin MS05-020
Cumulative Security Update for Internet Explorer (890923)

Source: CCN
Type: Microsoft Security Bulletin MS05-025
Cumulative Security Update for Internet Explorer (883939)

Source: CCN
Type: Microsoft Security Bulletin MS05-038
Cumulative Security Update for Internet Explorer (896727)

Source: CCN
Type: Microsoft Security Bulletin MS05-052
Cumulative Security Update for Internet Explorer (896688)

Source: CCN
Type: Microsoft Security Bulletin MS05-054
Cumulative Security Update for Internet Explorer (905915)

Source: CCN
Type: Microsoft Security Bulletin MS06-004
Cumulative Security Update for Internet Explorer (910620)

Source: CCN
Type: Microsoft Security Bulletin MS06-013
Cumulative Security Update for Internet Explorer (912812)

Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)

Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)

Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)

Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)

Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)

Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)

Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)

Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)

Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)

Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)

Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)

Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)

Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)

Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)

Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)

Source: CCN
Type: BID-11381
Microsoft Internet Explorer Plug-in Navigations Handling Address Bar Spoofing Vulnerability

Source: CERT
Type: Patch, Third Party Advisory, US Government Resource
TA04-293A

Source: MS
Type: UNKNOWN
MS04-038

Source: XF
Type: UNKNOWN
ie-ms04038-patch(17651)

Source: XF
Type: UNKNOWN
ie-plugin-address-spoofing(17655)

Source: XF
Type: UNKNOWN
ie-plugin-address-spoofing(17655)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:2487

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:2537

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:3949

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6313

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:7095

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:7194

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2000:-:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6a:*:*:server:*:x86:*
  • OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:-:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:4.0:sp6:*:*:terminal_server:*:x86:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:2487
    V
    		IE v6.0 Plug-in Navigation Address Bar Spoofing Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:7095
    V
    		IE v5.5,SP2 Plug-in Navigation Address Bar Spoofing Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:2537
    V
    		IE v5.01,SP4 Plug-in Navigation Address Bar Spoofing Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:7194
    V
    		IE v6.0,SP1 Plug-in Navigation Address Bar Spoofing Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:3949
    V
    		IE v5.01, SP3 Plug-in Navigation Address Bar Spoofing Vulnerability
    2014-02-24
    oval:org.mitre.oval:def:6313
    V
    		IE v6.0,SP1 for Server 2003 Plug-in Navigation Address Bar Spoofing Vulnerability
    2014-02-24
    BACK
    microsoft ie 6 windows_server_2003_sp1
    microsoft internet explorer 5.5
    microsoft ie 6.0
    microsoft ie 5.5 sp2
    microsoft ie 6.0 sp1
    microsoft windows 2000 - sp3
    microsoft windows xp - sp1
    microsoft windows 2000 - sp4
    microsoft windows nt 4.0 sp6a
    microsoft windows 2003_server
    microsoft windows 2003 server *
    microsoft windows 2003 server - sp1
    microsoft windows nt 4.0 sp6
    microsoft windows xp sp2