bugtraq - Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 13 Oct 2004 10:43:22 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE)

GreyMagic Security wrote:

<<snip>>
> Solution: 
> =========
> 
> Microsoft was first informed on 18 Feb 2002, a patch was finally released on
> 22 Aug 2002 after a long investigation and testing period. 
> 
> The patch may be downloaded from:
> http://www.microsoft.com/technet/security/bulletin/ms02-047.asp.
> 
> ** Update - 9 Oct 2004 **
> 
> There has been a regression in Internet Explorer that causes it to be
> vulnerable to this issue once again. The regression was spotted by Georgi
> Guninski in an advisory from 7-Oct-2004
> (http://www.guninski.com/where_do_you_want_billg_to_go_today_1.html). 
> 
> Interestingly enough, the regression is only visible when the <script> block
> is introduced as static HTML in the page, dynamic blocks (via
> document.write) are protected. 
> 
> Disable Active Scripting in order to protect yourself from this
> vulnerability.

This is far from the first time that MS has "fixed" a vulnerability by 
addressing the specific form presented in a PoC or used in some "in the 
wild" exploit, rather than by looking into the true underlying problem. 
I'd be very surprised if many more such regressions are not present in 
IE, but it's be a rather dull job testing for them all.

Of course, one of the reasons folk pay the "Windows tax" is for MS to 
do that dull, largely thankless and unseen (if done properly) work, on 
their behalf...

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854