full-disclosure - Maxthon browser search bar information disclosure advisory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4243fe6f.7db2c3c6.0905.4434@mx.gmail.com>
Date: Fri Mar 25 12:05:08 2005
From: avivra at gmail.com (Aviv Raff)
Subject: Maxthon browser search bar information disclosure
	advisory

Maxthon browser search bar information disclosure advisory

URL: http://www.raffon.net/advisories/maxthon/searchbarid.html
Date: March 25, 2005
Author: Aviv Raff 

Introduction

"Maxthon Internet Browser software is a powerful tabbed browser with a
highly customizable interface. It is based on the Internet Explorer browser
engine..." (from Maxthon website <http://www.maxthon.com/> ).
Maxthon installs by default a search utility bar, which contains an
information disclosure vulnerability.

Technical Details

Maxthon's API includes a property named "m2_search_text", which allows
plug-ins to interact with the search bar.
Any website the user visits can easily fetch the search bar's data using
this property, the same way plug-ins do.
Tested version: 1.2.0
Older versions might be affected too. 

Proof Of Concept

http://www.raffon.net/advisories/maxthon/searchbarpoc.html

Timetable

02-Mar-2005: Vendor informed.
03-Mar-2005: Vendor confirmed vulnerability.
24-Mar-2005: Vendor published a fixed version.
25-Mar-2005: Public disclosure.

Solution

Upgrade to version 1.2.1.

Disclaimer: The information in this advisory and any of its demonstrations
is provided "as is" without warranty of any kind.

-- Copyright C 2005 Aviv Raff. --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050325/f763097a/attachment.html