bugtraq - Re: XSS in Internet Explorer 6 and 7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1775114223.20081126203555@Zoller.lu>
Date: Wed, 26 Nov 2008 20:35:55 +0100
From: Thierry Zoller <Thierry@...ler.lu>
To: "MustLive" <mustlive@...security.com.ua>
Cc: bugtraq@...urityfocus.com
Subject: Re: XSS in Internet Explorer 6 and 7

Dear MustLivee,
M> Which is also
M> available on English (http://securityvulns.ru/Udocument911.html).

Refering to the above, could you briefly explain :

==============
This attack works in Internet Explorer when option “Initialize and
script ActiveX control not marked as safe” (for Local intranet) is turned
on (Enabled or Prompt). It's such bug in hole of Microsoft :-) and it's
method of bypassing of the bug. This setting is needed only during attack
via this XSS, when JS code placed on the same line, where there is a
comment. Because if it's on other line (i.e. without preceding comment),
then code will work and without this setting (Disable). That can be
achieved in case, when attack made not via XSS, but the attack code is
placed (in appropriate way) directly in body of page.
==============

Your saying above that this attack works if "Initialise and script
ActiveX control not marked as safe" is ENABLED.

Then you say that:
"if it's on other line (i.e. without preceding comment),
then code will work and without this setting (Disable)"

My question is, if this attack works with disabling access to unsafe
controls without "preceding comment", why use the preceding comment
at all ?

If I understood you correctly this only works if the page is saved to
the harddisk and then run?.

-- 
http://secdev.zoller.lu
Thierry Zoller