CVE-2006-4560
Summary
| CVE | CVE-2006-4560 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2006-09-06 00:04:00 UTC |
| Updated | 2018-10-17 21:37:00 UTC |
| Description | Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| (somewhat) breaking the same-origin policy by undermining dns-pinning | MISC | shampoo.antville.org | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| 31329 | OSVDB | www.osvdb.org | |
| Testing DNS Slurping | MISC | polyboy.net | Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.