CVE-2007-5277 — MEDIUM (4.3)

Vulnerability Description

Microsoft Internet Explorer 6 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80, a different issue than CVE-2006-4560.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Microsoft	Internet Explorer	6.0

References

http://crypto.stanford.edu/dns/dns-rebinding.pdfTechnical DescriptionThird Party Advisory
http://osvdb.org/45525Broken Link
http://crypto.stanford.edu/dns/dns-rebinding.pdfTechnical DescriptionThird Party Advisory
http://osvdb.org/45525Broken Link

FAQ

What is CVE-2007-5277?

CVE-2007-5277 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Microsoft Internet Explorer 6 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port...

How severe is CVE-2007-5277?

CVE-2007-5277 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2007-5277?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Internet Explorer.