NVD

Id
55820  
Name
CVE-2007-3670  
Description
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE"s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2007-07-10  
Modified Date
2013-08-22  
Seq
2007-3670  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
283786 55820 CVE-2007-3670 ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt  View
283787 55820 CVE-2007-3670 20070710 Internet Explorer 0day exploit  View
283788 55820 CVE-2007-3670 http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/  View
283789 55820 CVE-2007-3670 SSRT061181  View
283790 55820 CVE-2007-3670 SSRT061236  View
283791 55820 CVE-2007-3670 20070719 Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability  View
283792 55820 CVE-2007-3670 http://larholm.com/2007/07/10/internet-explorer-0day-exploit/  View
283793 55820 CVE-2007-3670 http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx  View
283794 55820 CVE-2007-3670 http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html  View
283795 55820 CVE-2007-3670 VU#358017  View
283796 55820 CVE-2007-3670 MDKSA-2007:152  View
283797 55820 CVE-2007-3670 http://www.mozilla.org/security/announce/2007/mfsa2007-23.html  View
283798 55820 CVE-2007-3670 http://www.mozilla.org/security/announce/2007/mfsa2007-40.html  View
283799 55820 CVE-2007-3670 SUSE-SA:2007:049  View
283800 55820 CVE-2007-3670 20070710 Internet Explorer 0day exploit  View
283801 55820 CVE-2007-3670 24837  View
283802 55820 CVE-2007-3670 1018351  View
283803 55820 CVE-2007-3670 1018360  View
283804 55820 CVE-2007-3670 http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/  View
283805 55820 CVE-2007-3670 USN-503-1  View
283806 55820 CVE-2007-3670 TA07-199A  View
283807 55820 CVE-2007-3670 http://www.virusbtn.com/news/virus_news/2007/07_11.xml  View
283808 55820 CVE-2007-3670 ADV-2007-2473  View
283809 55820 CVE-2007-3670 ADV-2007-2565  View
283810 55820 CVE-2007-3670 ADV-2007-4272  View
283811 55820 CVE-2007-3670 ADV-2008-0082  View
283812 55820 CVE-2007-3670 http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html  View
283813 55820 CVE-2007-3670 ie-firefoxurl-command-execution(35346)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51883 JVNDB-2007-000546 Microsoft Internet Explorer の特定の環境下における引数が挿入される脆弱性 Firefox がインストールされている環境化で、Internet Explorer において、引数を挿入できる脆弱性が存在し、結果的に任意のスクリプトや任意のコマンドを実行される可能性があります。 CVE-2007-3670 27025 CVE-2007-3670 55820 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000546.html 2007-07-10 2008-01-11 View