CVE-2000-0201: Medium severity Microsoft Internet Explorer vulnerability
The window.showHelp() method in Internet Explorer 5.x does not restrict HTML help files (.chm) to be executed from the local host, which allows remote attackers to execute arbitrary commands via Microsoft Networking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Prevent Internet Explorer from executing HTML Help (.chm) files from remote/network locations. Configure IE/Windows security (for example, zone settings or system policy) so that .chm files are allowed to execute only from the local host or disable the ability to execute .chm files from network shares.
Internet Explorer execution of HTML Help (.chm) from network locations / window.showHelp() = restrict to local host or disable - Compensating control
Restrict access to Microsoft Networking to mitigate remote exploitation (for example, block or filter SMB/CIFS traffic from untrusted networks — e.g., TCP ports 139 and 445 — at the perimeter firewall and limit file-share access to trusted hosts).
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0201?
CVE-2000-0201 is considered a high-severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2000-0201?
To fix CVE-2000-0201, it is recommended to upgrade to a newer version of Internet Explorer that does not have this vulnerability.
What systems are affected by CVE-2000-0201?
CVE-2000-0201 specifically affects Internet Explorer 5.0 and 5.01 versions.
Can CVE-2000-0201 be exploited remotely?
Yes, CVE-2000-0201 can be exploited remotely, allowing attackers to execute arbitrary commands on the affected system.
Is there a workaround for CVE-2000-0201?
A possible workaround for CVE-2000-0201 is to disable the use of the window.showHelp() method or to limit the execution of local help files.