CVE-2011-2382: Input Validation
Published Jun 3, 2011
·Updated
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
Affected Software
97 affected components
Microsoft ie=9-beta
Microsoft Internet Explorer<=8
Microsoft Internet Explorer=3.0
Microsoft Internet Explorer=3.0.1
Microsoft Internet Explorer=3.0.2
Microsoft Internet Explorer=3.1
Microsoft Internet Explorer=3.2
Microsoft Internet Explorer=4.0
Microsoft Internet Explorer=4.0.1
Microsoft Internet Explorer=4.0.1-sp1
Microsoft Internet Explorer=4.0.1-sp2
Microsoft Internet Explorer=4.01
Microsoft Internet Explorer=4.1
Microsoft Internet Explorer=4.01-sp1
Microsoft Internet Explorer=4.5
Microsoft Internet Explorer=4.40.308
Microsoft Internet Explorer=4.40.520
Microsoft Internet Explorer=4.70.1155
Microsoft Internet Explorer=4.70.1158
Microsoft Internet Explorer=4.70.1215
Microsoft Internet Explorer=4.70.1300
Microsoft Internet Explorer=4.71.544
Microsoft Internet Explorer=4.71.1008.3
Microsoft Internet Explorer=4.71.1712.6
Microsoft Internet Explorer=4.72.2106.8
Microsoft Internet Explorer=4.72.3110.8
Microsoft Internet Explorer=4.72.3612.1713
Microsoft Internet Explorer=5
Microsoft Internet Explorer=5.0
Microsoft Internet Explorer=5.0.1
Microsoft Internet Explorer=5.0.1-sp1
Microsoft Internet Explorer=5.0.1-sp2
Microsoft Internet Explorer=5.0.1-sp3
Microsoft Internet Explorer=5.0.1-sp4
Microsoft Internet Explorer=5.00.0518.10
Microsoft Internet Explorer=5.00.0910.1309
Microsoft Internet Explorer=5.00.2014.0216
Microsoft Internet Explorer=5.00.2314.1003
Microsoft Internet Explorer=5.00.2516.1900
Microsoft Internet Explorer=5.00.2614.3500
Microsoft Internet Explorer=5.00.2919.800
Microsoft Internet Explorer=5.00.2919.3800
Microsoft Internet Explorer=5.00.2919.6307
Microsoft Internet Explorer=5.00.2920.0000
Microsoft Internet Explorer=5.00.3103.1000
Microsoft Internet Explorer=5.00.3105.0106
Microsoft Internet Explorer=5.00.3314.2101
Microsoft Internet Explorer=5.00.3315.1000
Microsoft Internet Explorer=5.00.3502.1000
Microsoft Internet Explorer=5.00.3700.1000
Microsoft Internet Explorer=5.01
Microsoft Internet Explorer=5.1
Microsoft Internet Explorer=5.01-sp1
Microsoft Internet Explorer=5.01-sp2
Microsoft Internet Explorer=5.01-sp3
Microsoft Internet Explorer=5.01-sp4
Microsoft Internet Explorer=5.2.3
Microsoft Internet Explorer=5.5
Microsoft Internet Explorer=5.5-preview
Microsoft Internet Explorer=5.5-sp1
Microsoft Internet Explorer=5.5-sp2
Microsoft Internet Explorer=5.50.3825.1300
Microsoft Internet Explorer=5.50.4030.2400
Microsoft Internet Explorer=5.50.4134.0100
Microsoft Internet Explorer=5.50.4134.0600
Microsoft Internet Explorer=5.50.4308.2900
Microsoft Internet Explorer=5.50.4522.1800
Microsoft Internet Explorer=5.50.4807.2300
Microsoft Internet Explorer=6
Microsoft Internet Explorer=6-sp1
Microsoft Internet Explorer=6.0
Microsoft Internet Explorer=6.00.2462.0000
Microsoft Internet Explorer=6.00.2479.0006
Microsoft Internet Explorer=6.0.2600
Microsoft Internet Explorer=6.00.2600.0000
Microsoft Internet Explorer=6.0.2800
Microsoft Internet Explorer=6.0.2800.1106
Microsoft Internet Explorer=6.00.2800.1106
Microsoft Internet Explorer=6.0.2900
Microsoft Internet Explorer=6.0.2900.2180
Microsoft Internet Explorer=6.00.2900.2180
Microsoft Internet Explorer=6.00.3663.0000
Microsoft Internet Explorer=6.00.3718.0000
Microsoft Internet Explorer=6.00.3790.0000
Microsoft Internet Explorer=6.00.3790.1830
Microsoft Internet Explorer=6.00.3790.3959
Microsoft Internet Explorer=7
Microsoft Internet Explorer=7.0
Microsoft Internet Explorer=7.0-beta
Microsoft Internet Explorer=7.0-beta1
Microsoft Internet Explorer=7.0-beta2
Microsoft Internet Explorer=7.0-beta3
Microsoft Internet Explorer=7.0.5730-unknown
Microsoft Internet Explorer=7.0.5730.11
Microsoft Internet Explorer=7.00.5730.1100
Microsoft Internet Explorer=7.00.6000.16386
Microsoft Internet Explorer=7.00.6000.16441
Event History
Jun 3, 2011
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-2382?
CVE-2011-2382 is considered a high severity vulnerability due to its potential to allow attackers to access sensitive cookie information.
2
How do I fix CVE-2011-2382?
To fix CVE-2011-2382, users should update to the latest version of Internet Explorer that addresses this vulnerability.
3
Which versions of Internet Explorer are affected by CVE-2011-2382?
CVE-2011-2382 affects Microsoft Internet Explorer 8 and earlier, as well as Internet Explorer 9 beta.
4
What type of attack does CVE-2011-2382 facilitate?
CVE-2011-2382 facilitates a cross-zone drag-and-drop attack that allows attackers to read cookie files under certain conditions.
5
Is user interaction required to exploit CVE-2011-2382?
Yes, user interaction is required to exploit CVE-2011-2382, as the attacker needs to trick the user into performing specific actions.