NVD

Id
11824  
Name
CVE-2010-0255  
Description
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript exploit code that constructs a reference to a file://127.0.0.1 URL, aka the dynamic OBJECT tag vulnerability, as demonstrated by obtaining the data from an index.dat file, a variant of CVE-2009-1140 and related to CVE-2008-1448.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2010-02-04  
Modified Date
2010-08-21  
Seq
2010-0255  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
65137 11824 CVE-2010-0255 http://blogs.technet.com/msrc/archive/2010/02/03/security-advisory-980088-released.aspx  View
65138 11824 CVE-2010-0255 http://isc.sans.org/diary.html?n&storyid=8152  View
65139 11824 CVE-2010-0255 oval:org.mitre.oval:def:7145  View
65140 11824 CVE-2010-0255 http://support.avaya.com/css/P8/documents/100089747  View
65141 11824 CVE-2010-0255 http://www.coresecurity.com/content/internet-explorer-dynamic-object-tag  View
65142 11824 CVE-2010-0255 http://www.microsoft.com/technet/security/advisory/980088.mspx  View
65143 11824 CVE-2010-0255 MS10-035  View
65144 11824 CVE-2010-0255 20100203 CORE-2009-0625: Internet Explorer Dynamic OBJECT tag and URLMON sniffing vulnerabilities  View
65145 11824 CVE-2010-0255 38055  View
65146 11824 CVE-2010-0255 38056  View
65147 11824 CVE-2010-0255 TA10-159B  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35303 JVNDB-2010-001083 Microsoft Internet Explorer におけるアクセス制限を回避される脆弱性 Microsoft Internet Explorer には、HTML ドキュメントのように HTML 以外のローカルファイルをレンダリング制御しないため、アクセス制限を回避され、任意のファイルを読まれる脆弱性が存在します。 CVE-2010-0255 42835 CVE-2010-0255 11824 9.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001083.html 2010-02-03 2010-07-01 View