Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window an

Summary

Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).

Timeline

1. Sep 7, 2003Public exploit on Exploit-DB

   EDB-23114

2. Oct 7, 2003, 4:00 AM UTCCVE published
3. Aug 8, 2024, 2:05 AM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 12