Vulnerability Description
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Internet Explorer | 6.0 |
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047398.html
- http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060627/3d930eda
- http://secunia.com/advisories/20825Vendor Advisory
- http://secunia.com/advisories/21396
- http://secunia.com/internet_explorer_information_disclosure_vulnerability_test
- http://securitytracker.com/id?1016388
- http://www.kb.cert.org/vuls/id/883108US Government Resource
- http://www.securityfocus.com/archive/1/438785/100/0/threaded
- http://www.securityfocus.com/archive/1/438788/100/0/threaded
- http://www.securityfocus.com/archive/1/438811/100/0/threaded
- http://www.securityfocus.com/archive/1/438863/100/0/threaded
- http://www.securityfocus.com/archive/1/438864/100/0/threaded
- http://www.securityfocus.com/archive/1/439146/100/0/threaded
- http://www.securityfocus.com/bid/18682
- http://www.us-cert.gov/cas/techalerts/TA06-220A.htmlUS Government Resource
FAQ
What is CVE-2006-3280?
CVE-2006-3280 is a vulnerability with a CVSS score of 7.5 (HIGH). Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link...
How severe is CVE-2006-3280?
CVE-2006-3280 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-3280?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Internet Explorer.