CVE-2005-4827
First published: Sat Dec 31 2005(Updated: )
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name), which is supported by some proxy servers that convert tabs to spaces. NOTE: this issue can be leveraged to conduct referer spoofing, HTTP Request Smuggling, and other attacks.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Explorer | =6.0-windows_xp_sp2 | |
| Microsoft Internet Explorer | =6-windows_2000_sp4 | |
| Microsoft Internet Explorer | =6 | |
| Canon Network Camera Server VB101 | ||
| Microsoft Internet Explorer | =6.0 | |
| Microsoft Internet Explorer | =6-windows_server_2003_sp1_itanium_systems | |
| Microsoft Internet Explorer | =6.0 | |
| Microsoft Internet Explorer | =6.0-sp1 | |
| Internet Explorer | =6-sp1 | |
| Microsoft Internet Explorer | =6 | |
| Microsoft Internet Explorer | =6.0-sp2 | |
| Microsoft Internet Explorer | =6-sp1 | |
| Microsoft Internet Explorer | =6.0-sp1 | |
| Microsoft Internet Explorer | =6-sp1 | |
| Microsoft Internet Explorer | =6.0-sp1 | |
| Microsoft Internet Explorer | =6.0-sp2 | |
| Microsoft Internet Explorer | =6 | |
| Microsoft Internet Explorer | =6-windows_server_2003_sp1 | |
| Microsoft Internet Explorer | =6-windows_server_2003_sp1_itanium | |
| Microsoft Internet Explorer | =6.0 | |
| Microsoft Internet Explorer | =6-sp1 | |
| Microsoft Internet Explorer | =6-sp1 | |
| Microsoft Internet Explorer | =6 | |
| Microsoft Internet Explorer | =6-windows_xp_sp2 | |
| Internet Explorer | =6.0.2600 | |
| Internet Explorer | =6.0 | |
| Internet Explorer | =6.0.2800 | |
| Internet Explorer | =6.0.2800.1106 | |
| Internet Explorer | =6.0.2900.2180 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2005-4827?
CVE-2005-4827 is rated as a high severity vulnerability that allows attackers to bypass the same origin security policy in Internet Explorer.
How do I fix CVE-2005-4827?
To fix CVE-2005-4827, users should update their Internet Explorer to the latest version provided by Microsoft.
What versions of Internet Explorer are affected by CVE-2005-4827?
CVE-2005-4827 affects Internet Explorer versions 6.0 and may also impact earlier versions.
What kind of attacks can exploit CVE-2005-4827?
CVE-2005-4827 can be exploited by remote attackers to make requests to unauthorized domains using XMLHttpRequest objects.
Is there a workaround for CVE-2005-4827 if I can’t update?
As a temporary workaround for CVE-2005-4827, users can disable JavaScript or use different web browsers until an update is applied.
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- vendor/microsoft
- vendor/ie
- vendor/canon
- vendor/network camera server vb101
- vendor/internet explorer
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/microsoft internet explorer
- version/microsoft internet explorer/6.0-windows_xp_sp2
- version/microsoft internet explorer/6-windows_2000_sp4
- version/microsoft internet explorer/6
- canonical/canon network camera server vb101
- version/microsoft internet explorer/6.0
- version/microsoft internet explorer/6-windows_server_2003_sp1_itanium_systems
- version/microsoft internet explorer/6.0-sp1
- canonical/internet explorer
- version/internet explorer/6-sp1
- version/microsoft internet explorer/6.0-sp2
- version/microsoft internet explorer/6-sp1
- version/microsoft internet explorer/6-windows_server_2003_sp1
- version/microsoft internet explorer/6-windows_server_2003_sp1_itanium
- version/microsoft internet explorer/6-windows_xp_sp2
- version/internet explorer/6.0.2600
- version/internet explorer/6.0
- version/internet explorer/6.0.2800
- version/internet explorer/6.0.2800.1106
- version/internet explorer/6.0.2900.2180