CVE-2004-1166: Code Injection
CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1166?
CVE-2004-1166 has been rated as a medium severity vulnerability due to its potential for exploitation via crafted FTP commands.
How do I fix CVE-2004-1166?
To remediate CVE-2004-1166, users should upgrade to a later version of Microsoft Internet Explorer that does not have this vulnerability.
What are the effects of exploiting CVE-2004-1166?
Exploitation of CVE-2004-1166 may allow attackers to execute arbitrary FTP commands, potentially compromising user data.
What versions of Internet Explorer are affected by CVE-2004-1166?
CVE-2004-1166 affects Microsoft Internet Explorer versions 6.0.2800.1106 and earlier, including both SP1 and SP2.
Can CVE-2004-1166 be exploited remotely?
Yes, CVE-2004-1166 can be exploited remotely through specially crafted ftp:// URLs containing URL-encoded newlines.