CVE-2007-3550: Code Injection

Published Jul 3, 2007

Updated

DISPUTED Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing". NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated.

Affected Software

7 affected components

Microsoft ie=6.0-sp1

Microsoft ie=6.0-sp2

Microsoft Internet Explorer=6.0

Microsoft Internet Explorer=7.0

Microsoft Internet Explorer=7.0-beta1

Microsoft Internet Explorer=7.0-beta2

Microsoft Internet Explorer=7.0-beta3

Remediation

Patch Available

http://www.secniche.org/advisory/Internet_Dos_Adv.pdf

Event History

Jul 3, 2007

CVE Published

via NVD·09:30 PM

Disputed

09:30 PM

Jul 4, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3550?

CVE-2007-3550 has been classified as a denial of service vulnerability.

How do I fix CVE-2007-3550?

There is no specific fix for CVE-2007-3550, but upgrading to a newer version of Internet Explorer or applying security updates can mitigate the risk.

What versions of Internet Explorer are affected by CVE-2007-3550?

Internet Explorer versions 6.0 SP1, 6.0 SP2, and 7.0, including its beta versions, are affected by CVE-2007-3550.

What impact does CVE-2007-3550 have on web services?

CVE-2007-3550 can lead to website suppression and resource consumption, effectively disrupting web services.

Is CVE-2007-3550 exploitative for remote attackers?

Yes, CVE-2007-3550 allows remote attackers to exploit the vulnerability using JavaScript to fill Zones with arbitrary domains.