CVE-2003-1027

Description

Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."

10.0

CVSS

Severity: Critical

CVSS 2.0 •

EPSS 60.93% Top 5%

Vendor Advisory microsoft.com

Affected: n/a n/a

References

Link	Tags
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A527	vdb entry signature
http://www.kb.cert.org/vuls/id/413886	third party advisory us government resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A629	vdb entry signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A531	vdb entry signature
http://www.safecenter.net/UMBRELLAWEBV4/HijackClickV2
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A530	vdb entry signature
http://marc.info/?l=bugtraq&m=107038202225587&w=2	mailing list
http://www.us-cert.gov/cas/techalerts/TA04-033A.html	third party advisory us government resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-004	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A532	vdb entry signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A534	vdb entry signature
http://marc.info/?l=bugtraq&m=106979479719446&w=2	mailing list
https://exchange.xforce.ibmcloud.com/vulnerabilities/13844	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A529	vdb entry signature
http://www.securitytracker.com/id?1006036	vdb entry

Frequently Asked Questions

What is the severity of CVE-2003-1027?: CVE-2003-1027 has been scored as a critical severity vulnerability.
How to fix CVE-2003-1027?: To fix CVE-2003-1027, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2003-1027 being actively exploited in the wild?: It is possible that CVE-2003-1027 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~61% probability that this vulnerability will be exploited by malicious actors in the next 30 days.