| Vulnerability Name: | CVE-2005-3896 (CCN-20783) |
| Assigned: | 2005-05-31 |
| Published: | 2005-05-31 |
| Updated: | 2016-10-18 |
| Summary: | Mozilla allows remote attackers to cause a denial of service (CPU consumption) via a Javascript BODY onload event that calls the window function.
|
| CVSS v3 Severity: | 5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): None
Availibility (A): High |
|
| CVSS v2 Severity: | 7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
6.4 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete |
5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)
4.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete |
|
| Vulnerability Type: | CWE-Other
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-2005-1790
Source: MITRE
Type: CNA
CVE-2005-3896
Source: MITRE
Type: CNA
CVE-2005-3897
Source: BUGTRAQ
Type: UNKNOWN
20051123 IE BUG, Mozilla DOS?
Source: CCN
Type: BugTraq Mailing List, 2005-11-23 5:23:05
Re: IE BUG, Mozilla DOS?
Source: CCN
Type: SA15368
Microsoft Internet Explorer Multiple Vulnerabilities
Source: CCN
Type: SA15546
Microsoft Internet Explorer "window()" Arbitrary Code Execution Vulnerability
Source: CCN
Type: SA18064
Avaya Products Microsoft Windows Multiple Vulnerabilities
Source: CCN
Type: SA18311
Nortel Centrex IP Client Manager Multiple Vulnerabilities
Source: CCN
Type: SECTRACK ID: 1015251
Microsoft Internet Explorer Bug in Processing Mismatched Document Object Model Objects May Let Remote Users Execute Arbitrary Code
Source: MISC
Type: Exploit, Vendor Advisory
http://www.computerterrorism.com/research/ie/ct21-11-2005
Source: CCN
Type: US-CERT VU#887861
Microsoft Internet Explorer vulnerable to code execution via mismatched DOM objects
Source: CCN
Type: Microsoft Security Advisory (911302)
Vulnerability in the way Internet Explorer Handles onLoad Events Could Allow Remote Code Execution
Source: CCN
Type: Microsoft Security Bulletin MS05-054
Cumulative Security Update for Internet Explorer (905915)
Source: CCN
Type: Microsoft Security Bulletin MS06-004
Cumulative Security Update for Internet Explorer (910620)
Source: CCN
Type: Microsoft Security Bulletin MS06-013
Cumulative Security Update for Internet Explorer (912812)
Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)
Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)
Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)
Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)
Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)
Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)
Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)
Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)
Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)
Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)
Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)
Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)
Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)
Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)
Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)
Source: CCN
Type: Microsoft Internet Explorer Web page
Internet Explorer Home
Source: CCN
Type: OSVDB ID: 22268
Mozilla Firefox Javascript BODY Onload Event window() Function DoS
Source: CCN
Type: OSVDB ID: 79172
Apple Safari Javascript BODY Onload Event window() Function DoS
Source: CCN
Type: BID-13799
Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution Vulnerability
Source: CCN
Type: Internet Security Systems Protection Alert, November 22, 2005
Internet Explorer Javascript Window() Remote Code Execution
Source: XF
Type: UNKNOWN
javascript-window-code-execution(20783)
Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [01-15-2012]
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:mozilla:mozilla:*:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/a:opera:opera_browser:*:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:*OR cpe:/a:apple:safari:2.0.2:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:*:x64:*:*:*:*:*OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*OR cpe:/o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows:2003_server:sp1_itanium:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |