cbcvebase.
CVE-2003-1041
published 2004-06-14

CVE-2003-1041: Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot…

PriorityP267high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
52.61%
98.8th percentile
Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.

Affected

12 ranges
VendorProductVersion rangeFixed in
avayamodular_messaging_message_storage_server
microsoftie
microsoftie
microsoftinternet_explorer
microsoftinternet_explorer
microsoftinternet_explorer
microsoftwindows_2003_server
microsoftwindows_2003_server
microsoftwindows_2003_server
microsoftwindows_2003_server
microsoftwindows_2003_server
microsoftwindows_nt

Detection & IOCsextracted from sources · hover to see the quote

commandshowHelp("mk:@MSITStore:iexplore.chm::..\\..\\..\\..\\chmfile.chm::/fileinchm.html");
filenamehh.exe
filename.CHM
  • Monitor for use of the mk:@MSITStore: URI protocol handler combined with directory traversal sequences (e.g., ..\..\) in showHelp() calls, which is the core bypass technique for CVE-2003-1041.
  • Treat Internet Explorer, Outlook, and Outlook Express as attack surface vectors for this vulnerability — monitor for CHM file loads originating from these processes.
  • Flag any web page or email invoking showHelp() with a mk:@MSITStore: reference pointing to a local .CHM file, as this is the exploitation pattern described in MS03-004.
  • ·CVE-2003-1041 is explicitly a different vulnerability from CVE-2004-0201 (heap overflow in hh.exe); do not conflate the two — CVE-2003-1041 is the showHelp() directory traversal bypass, not the large length field heap overflow.
  • ·This issue was initially misattributed to Internet Explorer alone; it is an OS-level flaw, meaning patching IE is insufficient — the underlying Windows showHelp/CHM handling must be patched.

CVSS provenance

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.