CVE-2004-0985
Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file type such as .xml, .doc, .py, .cdf, .css, .pdf, or .ppt, and using ADODB.Connection and ADODB.recordset to write to a .hta file that is interpreted in the Local Zone by HTML Help.
Published
2004-12-31T05:00:00.000
Last Modified
2025-04-03T01:03:51.193
Status
Deferred
Source
[email protected]
Severity
CVSSv2: 10.0 (HIGH)
CVSSv2 Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access Vector: NETWORK
- Access Complexity: LOW
- Authentication: NONE
- Confidentiality Impact: COMPLETE
- Integrity Impact: COMPLETE
- Availability Impact: COMPLETE
Exploitability Score
10.0
Impact Score
10.0
Weaknesses
-
Type: Primary
NVD-CWE-Other
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
microsoft
|
ie
|
6.0 |
Yes
|
References