Internet Explorer Code Execution Bypass Vulnerability

From: aikon none (aikon.bcn_at_gmail.com)
Date: 12/17/04

  • Next message: Martin Schulze: "[SECURITY] [DSA 610-1] New cscope packages fix insecure temporary file creation" 
    Date: 17 Dec 2004 17:03:37 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Last week I discovered a vulnerability to avoid/overrun/bypass the new protection for Local JS Execution on IE (winxp sp2)

    --cut here--

    <script>
    window.alert("Example Exploit");
    </script>

    --cut here--

    (Copy and paste into your Notepad and save it as EXAMPLE.HTM)

    If you open EXAMPLE.HTM, your IE blocks this code and shows a yellow bar over the webpag.

    But I discovered a vulnerability to allow Local JS Code to execute on IE, the exploit is:

    "Go to Control Panel / Display Config and set as the desktop background the example webpage (EXAMPLE.HTM), once this is done, the code will be executed without showing any warning in IE"

    ----------------------

    My Webpag: www.madantrax.cjb.net
    My ClanWeb: www.darknessteam.com
    ForumClan: foro.darknessteam.com

  • Next message: Martin Schulze: "[SECURITY] [DSA 610-1] New cscope packages fix insecure temporary file creation"