CVE-2004-0979
Description
Internet Explorer on Windows XP does not properly modify the "Drag and Drop or copy and paste files" setting when the user sets it to "Disable" or "Prompt," which may enable security-sensitive operations that are inconsistent with the user's intended configuration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
The AI Insight narrative is available to signed-in members. Sign in or create a free account to read it.
Affected products
16cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
- (no CPE)range: on Windows XP
cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*+ 11 more
- cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:*:embedded:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp1:embedded:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp2:home:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*
Patches
Discovered fix commits and diffs is available to signed-in members. Sign in or create a free account to read it.
Vulnerability mechanics
Root cause
"The "Drag and Drop or copy and paste files" security setting in Internet Explorer on Windows XP fails to enforce the user's "Disable" or "Prompt" configuration, allowing file operations to proceed without restriction."
Attack vector
An attacker could craft a malicious web page that initiates drag-and-drop or copy-and-paste operations on the user's system. Because the security setting fails to enforce the user's intended "Disable" or "Prompt" configuration, the operation proceeds without restriction or user consent [ref_id=1]. This allows the attacker to move or copy files from one location to another, potentially placing executable content in a startup folder or other sensitive location. The attack requires the user to visit the attacker's web page in Internet Explorer on Windows XP.
Affected code
The vulnerability exists in the Internet Explorer security zone settings handling on Windows XP. The "Drag and Drop or copy and paste files" security setting did not properly enforce the "Disable" or "Prompt" configuration chosen by the user [ref_id=1]. The advisory states that "if this setting was set to Disable or Prompt for a particular zone on Windows XP, it would not disable or prompt when dragging, dropping, copying or pasting files as documented" [ref_id=1].
What the fix does
The security update (MS04-038) "repairs the behavior of the 'Drag and Drop or copy and paste files' security setting on Internet Explorer on Windows XP" [ref_id=1]. The fix ensures that when the user sets this setting to "Disable" or "Prompt" for a particular zone, Internet Explorer actually blocks or prompts the user before allowing drag-and-drop or copy-and-paste file operations, matching the documented behavior described in "Setting up Security Zones" [ref_id=1]. No patch diff is available in the bundle.
Preconditions
- configUser must be running Internet Explorer on Windows XP
- inputUser must visit a malicious web page controlled by the attacker
- configThe 'Drag and Drop or copy and paste files' security setting must be configured to 'Disable' or 'Prompt' for the relevant zone
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.kb.cert.org/vuls/id/630720nvdThird Party AdvisoryUS Government Resource
- www.us-cert.gov/cas/techalerts/TA04-293A.htmlnvdUS Government Resource
- docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/17820nvd
News mentions
0No linked articles in our index yet.