NetSight
IP …
high7.1

CVE-2007-3091

Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for…

Impact

Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code or perform other actions upon a page transition, with the permissions of the old page and the content of the new page, as demonstrated by setInterval functions that set location.href within a try/catch expression, aka the "bait & switch vulnerability" or "Race Condition Cross-Domain Information Disclosure Vulnerability."

Affected products

VendorProductAffected versions
MicrosoftWindows 2003 Server
Versions sp1, sp2
MicrosoftWindows Xp
All versions
MicrosoftInternet Explorer
Versions 6, 7.0
MicrosoftWindows 2000
All versions
MicrosoftWindows Server 2008
All versions
MicrosoftWindows Vista
All versions

Weakness classification

CWE-362

References