CVE-2011-2382: Input Validation
First published: Fri Jun 03 2011(Updated: )
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Explorer | <=8 | |
| Microsoft Internet Explorer | =5 | |
| Microsoft Internet Explorer | =6-sp1 | |
| Microsoft Internet Explorer | =5.01-sp4 | |
| Microsoft Ie | =9-beta | |
| Microsoft Internet Explorer | =7 | |
| Microsoft Internet Explorer | =6 | |
| Microsoft Internet Explorer | =5.01 | |
| Microsoft Internet Explorer | =5.01-sp3 | |
| Microsoft Internet Explorer | =5.5-sp2 | |
| Microsoft Internet Explorer | =3.0.1 | |
| Microsoft Internet Explorer | =3.0.2 | |
| Microsoft Internet Explorer | =3.0 | |
| Microsoft Internet Explorer | =3.1 | |
| Microsoft Internet Explorer | =3.2 | |
| Microsoft Internet Explorer | =4.0 | |
| Microsoft Internet Explorer | =4.0.1 | |
| Microsoft Internet Explorer | =4.0.1-sp2 | |
| Microsoft Internet Explorer | =4.0.1-sp1 | |
| Microsoft Internet Explorer | =4.01 | |
| Microsoft Internet Explorer | =4.01-sp1 | |
| Microsoft Internet Explorer | =4.1 | |
| Microsoft Internet Explorer | =4.5 | |
| Microsoft Internet Explorer | =4.40.308 | |
| Microsoft Internet Explorer | =4.40.520 | |
| Microsoft Internet Explorer | =4.70.1155 | |
| Microsoft Internet Explorer | =4.70.1158 | |
| Microsoft Internet Explorer | =4.70.1215 | |
| Microsoft Internet Explorer | =4.70.1300 | |
| Microsoft Internet Explorer | =4.72.3612.1713 | |
| Microsoft Internet Explorer | =4.71.544 | |
| Microsoft Internet Explorer | =4.71.1008.3 | |
| Microsoft Internet Explorer | =4.71.1712.6 | |
| Microsoft Internet Explorer | =4.72.2106.8 | |
| Microsoft Internet Explorer | =4.72.3110.8 | |
| Microsoft Internet Explorer | =5.0 | |
| Microsoft Internet Explorer | =5.0.1 | |
| Microsoft Internet Explorer | =5.0.1-sp2 | |
| Microsoft Internet Explorer | =5.0.1-sp3 | |
| Microsoft Internet Explorer | =5.0.1-sp4 | |
| Microsoft Internet Explorer | =5.0.1-sp1 | |
| Microsoft Internet Explorer | =5.00.0518.10 | |
| Microsoft Internet Explorer | =5.00.0910.1309 | |
| Microsoft Internet Explorer | =5.00.2014.0216 | |
| Microsoft Internet Explorer | =5.00.2314.1003 | |
| Microsoft Internet Explorer | =5.00.2614.3500 | |
| Microsoft Internet Explorer | =5.00.2516.1900 | |
| Microsoft Internet Explorer | =5.00.2919.800 | |
| Microsoft Internet Explorer | =5.00.2919.3800 | |
| Microsoft Internet Explorer | =5.00.2919.6307 | |
| Microsoft Internet Explorer | =5.00.2920.0000 | |
| Microsoft Internet Explorer | =5.00.3103.1000 | |
| Microsoft Internet Explorer | =5.00.3105.0106 | |
| Microsoft Internet Explorer | =5.00.3314.2101 | |
| Microsoft Internet Explorer | =5.00.3315.1000 | |
| Microsoft Internet Explorer | =5.00.3502.1000 | |
| Microsoft Internet Explorer | =5.00.3700.1000 | |
| Microsoft Internet Explorer | =5.50.3825.1300 | |
| Microsoft Internet Explorer | =5.50.4030.2400 | |
| Microsoft Internet Explorer | =5.50.4134.0100 | |
| Microsoft Internet Explorer | =5.50.4134.0600 | |
| Microsoft Internet Explorer | =5.50.4308.2900 | |
| Microsoft Internet Explorer | =5.50.4522.1800 | |
| Microsoft Internet Explorer | =5.50.4807.2300 | |
| Microsoft Internet Explorer | =5.5 | |
| Microsoft Internet Explorer | =5.01-sp1 | |
| Microsoft Internet Explorer | =5.01-sp2 | |
| Microsoft Internet Explorer | =5.1 | |
| Microsoft Internet Explorer | =5.2.3 | |
| Microsoft Internet Explorer | =5.5-preview | |
| Microsoft Internet Explorer | =5.5-sp1 | |
| Microsoft Internet Explorer | =6.0.2600 | |
| Microsoft Internet Explorer | =6.00.2462.0000 | |
| Microsoft Internet Explorer | =6.00.2479.0006 | |
| Microsoft Internet Explorer | =6.0 | |
| Microsoft Internet Explorer | =6.0.2800 | |
| Microsoft Internet Explorer | =6.0.2800.1106 | |
| Microsoft Internet Explorer | =6.0.2900 | |
| Microsoft Internet Explorer | =6.00.2600.0000 | |
| Microsoft Internet Explorer | =6.00.2800.1106 | |
| Microsoft Internet Explorer | =6.0.2900.2180 | |
| Microsoft Internet Explorer | =7.0.5730-unknown | |
| Microsoft Internet Explorer | =7.0-beta | |
| Microsoft Internet Explorer | =7.0 | |
| Microsoft Internet Explorer | =7.0.5730.11 | |
| Microsoft Internet Explorer | =6.00.2900.2180 | |
| Microsoft Internet Explorer | =6.00.3663.0000 | |
| Microsoft Internet Explorer | =6.00.3718.0000 | |
| Microsoft Internet Explorer | =6.00.3790.0000 | |
| Microsoft Internet Explorer | =6.00.3790.1830 | |
| Microsoft Internet Explorer | =6.00.3790.3959 | |
| Microsoft Internet Explorer | =7.0-beta1 | |
| Microsoft Internet Explorer | =7.0-beta2 | |
| Microsoft Internet Explorer | =7.0-beta3 | |
| Microsoft Internet Explorer | =7.00.5730.1100 | |
| Microsoft Internet Explorer | =7.00.6000.16386 | |
| Microsoft Internet Explorer | =7.00.6000.16441 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.networkworld.com/community/node/74259
- http://www.youtube.com/watch?v=V95CX-3JpK0
- http://www.theregister.co.uk/2011/05/25/microsoft_internet_explorer_cookiejacking/
- http://ju12.tistory.com/attachment/cfile4.uf@151FAB4C4DDC9E0002A6FE.ppt
- http://www.informationweek.com/news/security/vulnerabilities/229700031
- http://news.cnet.com/8301-1009_3-20066419-83.html
- http://www.eweek.com/c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/
- http://www.youtube.com/watch?v=VsSkcnIFCxM
- https://sites.google.com/site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt
- http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=1388
- http://ju12.tistory.com/attachment/cfile4.uf%40151FAB4C4DDC9E0002A6FE.ppt
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft internet explorer
- version/microsoft internet explorer/8
- version/microsoft internet explorer/5
- version/microsoft internet explorer/6-sp1
- version/microsoft internet explorer/5.01-sp4
- canonical/microsoft ie
- version/microsoft ie/9-beta
- version/microsoft internet explorer/7
- version/microsoft internet explorer/6
- version/microsoft internet explorer/5.01
- version/microsoft internet explorer/5.01-sp3
- version/microsoft internet explorer/5.5-sp2
- version/microsoft internet explorer/3.0.1
- version/microsoft internet explorer/3.0.2
- version/microsoft internet explorer/3.0
- version/microsoft internet explorer/3.1
- version/microsoft internet explorer/3.2
- version/microsoft internet explorer/4.0
- version/microsoft internet explorer/4.0.1
- version/microsoft internet explorer/4.0.1-sp2
- version/microsoft internet explorer/4.0.1-sp1
- version/microsoft internet explorer/4.01
- version/microsoft internet explorer/4.01-sp1
- version/microsoft internet explorer/4.1
- version/microsoft internet explorer/4.5
- version/microsoft internet explorer/4.40.308
- version/microsoft internet explorer/4.40.520
- version/microsoft internet explorer/4.70.1155
- version/microsoft internet explorer/4.70.1158
- version/microsoft internet explorer/4.70.1215
- version/microsoft internet explorer/4.70.1300
- version/microsoft internet explorer/4.72.3612.1713
- version/microsoft internet explorer/4.71.544
- version/microsoft internet explorer/4.71.1008.3
- version/microsoft internet explorer/4.71.1712.6
- version/microsoft internet explorer/4.72.2106.8
- version/microsoft internet explorer/4.72.3110.8
- version/microsoft internet explorer/5.0
- version/microsoft internet explorer/5.0.1
- version/microsoft internet explorer/5.0.1-sp2
- version/microsoft internet explorer/5.0.1-sp3
- version/microsoft internet explorer/5.0.1-sp4
- version/microsoft internet explorer/5.0.1-sp1
- version/microsoft internet explorer/5.00.0518.10
- version/microsoft internet explorer/5.00.0910.1309
- version/microsoft internet explorer/5.00.2014.0216
- version/microsoft internet explorer/5.00.2314.1003
- version/microsoft internet explorer/5.00.2614.3500
- version/microsoft internet explorer/5.00.2516.1900
- version/microsoft internet explorer/5.00.2919.800
- version/microsoft internet explorer/5.00.2919.3800
- version/microsoft internet explorer/5.00.2919.6307
- version/microsoft internet explorer/5.00.2920.0000
- version/microsoft internet explorer/5.00.3103.1000
- version/microsoft internet explorer/5.00.3105.0106
- version/microsoft internet explorer/5.00.3314.2101
- version/microsoft internet explorer/5.00.3315.1000
- version/microsoft internet explorer/5.00.3502.1000
- version/microsoft internet explorer/5.00.3700.1000
- version/microsoft internet explorer/5.50.3825.1300
- version/microsoft internet explorer/5.50.4030.2400
- version/microsoft internet explorer/5.50.4134.0100
- version/microsoft internet explorer/5.50.4134.0600
- version/microsoft internet explorer/5.50.4308.2900
- version/microsoft internet explorer/5.50.4522.1800
- version/microsoft internet explorer/5.50.4807.2300
- version/microsoft internet explorer/5.5
- version/microsoft internet explorer/5.01-sp1
- version/microsoft internet explorer/5.01-sp2
- version/microsoft internet explorer/5.1
- version/microsoft internet explorer/5.2.3
- version/microsoft internet explorer/5.5-preview
- version/microsoft internet explorer/5.5-sp1
- version/microsoft internet explorer/6.0.2600
- version/microsoft internet explorer/6.00.2462.0000
- version/microsoft internet explorer/6.00.2479.0006
- version/microsoft internet explorer/6.0
- version/microsoft internet explorer/6.0.2800
- version/microsoft internet explorer/6.0.2800.1106
- version/microsoft internet explorer/6.0.2900
- version/microsoft internet explorer/6.00.2600.0000
- version/microsoft internet explorer/6.00.2800.1106
- version/microsoft internet explorer/6.0.2900.2180
- version/microsoft internet explorer/7.0.5730-unknown
- version/microsoft internet explorer/7.0-beta
- version/microsoft internet explorer/7.0
- version/microsoft internet explorer/7.0.5730.11
- version/microsoft internet explorer/6.00.2900.2180
- version/microsoft internet explorer/6.00.3663.0000
- version/microsoft internet explorer/6.00.3718.0000
- version/microsoft internet explorer/6.00.3790.0000
- version/microsoft internet explorer/6.00.3790.1830
- version/microsoft internet explorer/6.00.3790.3959
- version/microsoft internet explorer/7.0-beta1
- version/microsoft internet explorer/7.0-beta2
- version/microsoft internet explorer/7.0-beta3
- version/microsoft internet explorer/7.00.5730.1100
- version/microsoft internet explorer/7.00.6000.16386
- version/microsoft internet explorer/7.00.6000.16441