Intrusion Prevention

MS.IE.CDF.File.Cross.Domain.Scripting

Description

It indicates a possible exploit of a Cross-Zone scripting vulnerability in Microsoft Internet Explorer.
Using Channel Definition Format (CDF), a set of related Web pages can be organized into a logical hierarchy and stored in a file. A cross-zone scripting vulnerability is reported that may allow an attacker to steal information or execute arbitrary code on the user browser session within the security context of the Internet zone. Certain URLs found in CDF files are not properly validated by Internet Explorer, which may allow a "CHANNEL" tag to contain a reference to a "javascript:" URL. An attacker could exploit this vulnerability by creating a malicious Web page and hosting it on a Web site, or by sending it to a victim as an HTML email. Arbitrary code could be executed in the users browser session once the channel is added. A channel is a Web site described by a Channel Definition Format (CDF) file.

Affected Products

Microsoft Internet Explorer 6.0 SP2 and earlier versions.

Impact

Compromised of the affected system.

Recommended Actions

Apply security patch to the system as given in the Microsoft Security Bulletin MS05-014.

CVE References

CVE-2005-0056