7.1

CVE-2008-1544

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Internet Explorer Version 5.01 Update sp4
   Microsoft ≫ Windows 2000 Update sp4
Microsoft ≫ Internet Explorer Version 6 Update sp1
   Microsoft ≫ Windows 2000 Update sp4
Microsoft ≫ Internet Explorer Version 6
   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Update sp1
   Microsoft ≫ Windows Server 2003 Update sp1 Edition itanium
   Microsoft ≫ Windows Server 2003 Update sp2
   Microsoft ≫ Windows Xp Edition x64
   Microsoft ≫ Windows Xp Update sp2
   Microsoft ≫ Windows Xp Update sp2 Edition pro_x64
   Microsoft ≫ Windows Xp Update sp3
Microsoft ≫ Internet Explorer Version 7
   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Server 2003 Update sp1
   Microsoft ≫ Windows Server 2003 Update sp1 Edition itanium
   Microsoft ≫ Windows Server 2003 Update sp2
   Microsoft ≫ Windows Server 2008
   Microsoft ≫ Windows Server 2008 Edition itanium
   Microsoft ≫ Windows Server 2008 Edition x64
   Microsoft ≫ Windows Vista
   Microsoft ≫ Windows Vista Edition x64
   Microsoft ≫ Windows Vista Update sp1
   Microsoft ≫ Windows Xp Edition pro_x64
   Microsoft ≫ Windows Xp Update sp2
   Microsoft ≫ Windows Xp Update sp2 Edition pro_x64
   Microsoft ≫ Windows Xp Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 26.32% 0.977
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:C/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://marc.info/?l=bugtraq&m=121380194923597&w=2
http://www.us-cert.gov/cas/techalerts/TA08-162B.html
US Government Resource
http://secunia.com/advisories/29453
Vendor Advisory
http://securityreason.com/securityalert/3785
http://www.mindedsecurity.com/MSA02240108.html
http://www.securityfocus.com/archive/1/489954/100/0/threaded
http://www.securityfocus.com/bid/28379
Patch
http://www.securitytracker.com/id?1020226
http://www.vupen.com/english/advisories/2008/0980
Vendor Advisory
http://www.vupen.com/english/advisories/2008/1778
Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-031
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5291