CVE-2005-1989

An attacker hosts a malicious web page that, when viewed in Internet Explorer 5.0, 5.5, or 6.0, navigates the browser to a Web Folder view using WebDAV. Because the cross-domain security check is not properly applied during this navigation, the web page can read content or obtain information from the Web Folder view, which resides in a different security zone [ref_id=1]. The advisory rates the impact as Information Disclosure (Moderate severity) and notes that under certain conditions this could also lead to code execution [ref_id=1]. The attacker does not need any special network position beyond hosting a web site that the victim visits.

The advisory does not specify individual functions or file paths. The vulnerability exists in the cross-domain security logic of Internet Explorer 5.0, 5.5, and 6.0 as it relates to Web Folder behaviors using WebDAV [ref_id=1].

The security update (MS05-038) corrects how Internet Explorer enforces cross-domain security restrictions when handling Web Folder behaviors via WebDAV [ref_id=1]. The patch ensures that the browser properly validates zone transitions when navigating between a web site and a Web Folder view, preventing a page in one domain from accessing content in another domain. No source-level patch diff is available in the bundle; the advisory is the sole source of remediation guidance [ref_id=1].