cbcvebase.
CVE-2003-0838
published 2003-11-17

CVE-2003-0838: Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX…

PriorityP335high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
35.29%
98.3th percentile
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftie——
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——

Detection & IOCsextracted from sources · hover to see the quote

filenameaolfix.exe↗
commandvar oPopup = window.createPopup(); function showPopup() { oPopup.document.body.innerHTML = ""; oPopup.show(0,0,1,1,document.body); } showPopup()↗
  • →Detect use of window.createPopup() combined with an object tag using a 'data' attribute in HTML/JS content — this is the exploit primitive for CVE-2003-0838 ↗
  • →Monitor for HTA (HTML Application) execution spawned from Internet Explorer child processes, particularly when preceded by popup window creation via window.createPopup() ↗
  • →Alert on presence or execution of aolfix.exe, the known QHosts Trojan dropper associated with in-the-wild exploitation of this CVE ↗
  • →Inspect HTTP responses for object tags with 'data' attributes served to IE clients — the vulnerability triggers when IE fails to validate the object type in the HTTP response to a popup window ↗
  • ·Affects Internet Explorer 5 and 6 only; modern IE versions and other browsers are not affected by this specific zone-bypass via createPopup()/object data tag technique ↗
  • ·This is a distinct vulnerability from CVE-2003-0532 despite similar zone-bypass impact; detection rules should not conflate the two ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.