[NT] Cross-Frame Security Zone Spoofing in Internet Explorer Using the 'About' Protocol

From: support@securiteam.com
Date: 12/13/01 

From: support@securiteam.com
To: list@securiteam.com
Date: Thu, 13 Dec 2001 20:03:57 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Cross-Frame Security Zone Spoofing in Internet Explorer Using the 'About'
Protocol
------------------------------------------------------------------------

SUMMARY

By appending a simple percent sign after an 'about' URL that has opened in
a window you can access some elements of the previous document's object
model.
This means that you can run a script in the security context of "My
Computer" or "Trust Sites" and embed IFRAMES (text/x-scriptlet objects)
from varying domains and protocols while the Security Zone still reads "My
Computer" or "Trusted Sites". The limitations in this exploit are from the
about pluggable protocols security restrictions and security restrictions
on embedded objects within this protocol (if you have the latest patches).

DETAILS

Vulnerable systems:
Internet Explorer version 6.0.2600.0000
Internet Explorer version 5.50.4134.0100

Exploits:
All exploit code is available from:
 <http://www.osioniusx.com> http://www.osioniusx.com

"trustedSites.html" - Opens an about page in a trusted zone and navigates
to a JavaScript URL while remaining in the Trusted Zone.

"Domains.html" - Opens two remote sites up in IFRAMES while remaining in
the My Computer Zone (instead of mixed). You could just as well open up
hta, .vbs, even .bat files in this manner.

"MyComputer.html" - Opens about page in My Computer zone and navigates to
a JavaScript URL.

ADDITIONAL INFORMATION

The information has been provided by <mailto:osioniusx@yahoo.com> the
Pull.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • RE: Comments on 5 IE vulnerabilities
    ... For those who have opened up the Internet Options, ... Enterprise Security and Privacy Programs ... Despite the severity of some of the vulnerabilities posted by Liu Die Yu, ... I have locked down the My Computer security zone ...
    (Focus-Microsoft)
  • Re: drag and drop prompting
    ... Your current security settings prohibit copying or moving files from this ... First you have to Enable the My Computer Security Zone in Internet Options. ...
    (microsoft.public.windowsxp.general)
  • Re: drag and drop prompting
    ... Your current security settings prohibit copying or moving files from this ... First you have to Enable the My Computer Security Zone in Internet Options. ...
    (microsoft.public.windowsxp.general)
  • Re: drag and drop prompting
    ... Your current security settings prohibit copying or moving files from this ... First you have to Enable the My Computer Security Zone in Internet Options. ...
    (microsoft.public.windowsxp.general)
  • Re: drag and drop prompting
    ... I simply turned on prompting for intranet zone on a ... Your current security settings prohibit copying or moving files from this ... First you have to Enable the My Computer Security Zone in Internet Options. ...
    (microsoft.public.windowsxp.general)