First published: Fri Dec 31 1999(Updated: )
Internet Explorer 4 treats a 32-bit number ("dotless IP address") in the a URL as the hostname instead of an IP address, which causes IE to apply Local Intranet Zone settings to the resulting web page, allowing remote malicious web servers to conduct unauthorized activities by using URLs that contain the dotless IP address for their server.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Internet Explorer | =4.0 | |
Internet Explorer | =4.0.1 | |
Internet Explorer | =4.0.1-sp1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-1999-1087 is considered to have a moderate severity level due to its potential for unauthorized access and activities.
To fix CVE-1999-1087, upgrade your Internet Explorer to a version that does not allow dotless IP handling.
CVE-1999-1087 affects Internet Explorer versions 4.0, 4.0.1, and 4.0.1 SP1.
CVE-1999-1087 may lead to security vulnerabilities where malicious websites can exploit lax security zone settings.
CVE-1999-1087 is mainly a concern for legacy systems still running outdated versions of Internet Explorer.