bugtraq - Re: Browser bugs hit IE, Firefox today (SANS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 12 Jul 2006 15:52:55 -0400
From: 3CO <threecheeseopera@...il.com>
To: thor@...ypath.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Browser bugs hit IE, Firefox today (SANS)


On 7/4/06, Thor Larholm <thor@...ypath.com> wrote:
> However, reading the contentDocument property of the DOM element instead
> of the through the frames collection will give you a reference to the
> document object inside the thirdparty domain and even allow you to
> overwrite native DOM methods without throwing a security exception, such
> as
> document.getElementById("thirdparty").contentDocument.getElementById=function(s){alert(s)}.


This code throws an exception in Firefox 1.5.0.4:
"Error: uncaught exception: Permission denied to set property
HTMLDocument.getElementById
"

Just obtaining a reference to the contentDocument works, but any
action on it throws an error.