CVE-1999-1472: Medium severity Microsoft Internet Explorer vulnerability
Internet Explorer 4.0 allows remote attackers to read arbitrary text and HTML files on the user's machine via a small IFRAME that uses Dynamic HTML (DHTML) to send the data to the attacker, aka the Freiburg text-viewing issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Dynamic HTML (DHTML) / Active Scripting (JavaScript) in Internet Explorer security settings to prevent DHTML-based IFRAME content from reading and exfiltrating local text/HTML files.
Internet Explorer Dynamic HTML / Active Scripting = Disabled - Configuration
Prevent web pages from reading local files by tightening security for the Local Machine/Internet zones (disable or restrict web content access to local file system, e.g., enable Local Machine Zone lockdown or set zone security to disallow file access).
Internet Explorer Allow web pages to access local files = Disabled/Restricted - Compensating control
Use network-level controls (web proxy, firewall or content filtering) to block or restrict access to untrusted or malicious web pages that could host the small IFRAME/DHTML exploit.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1472?
CVE-1999-1472 is considered a high severity vulnerability due to the potential for remote attackers to access sensitive files on a user's machine.
How do I fix CVE-1999-1472?
To fix CVE-1999-1472, users should upgrade to a more secure version of Internet Explorer or apply available patches from Microsoft.
What type of attack does CVE-1999-1472 enable?
CVE-1999-1472 enables remote attackers to exploit Dynamic HTML to read arbitrary files on the victim's machine.
Which versions of Internet Explorer are affected by CVE-1999-1472?
CVE-1999-1472 specifically affects Internet Explorer version 4.0.
Can CVE-1999-1472 be exploited without user interaction?
Yes, CVE-1999-1472 can be exploited remotely without requiring any user interaction.