Bugtraq mailing list archives
Re: Internet Explorer URL parsing vulnerability
From: Tiago Pierezan Camargo <tiago () telenova net>
Date: Wed, 10 Dec 2003 17:37:57 -0200
Not true.. tested it on: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031110 Firebird/0.7 Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007 Firebird/0.7 Em Ter, 2003-12-09 às 22:13, Pedro Castro escreveu:
It does also apply to Mozilla Firebird 0.7. John W. Noerenberg II wrote:This exploit also applies to the Macintosh version of Explorer v5.2.3(5815.1)From: <bugtraq () zapthedingbat com> To: bugtraq () securityfocus com Subject: Internet Explorer URL parsing vulnerability Internet Explorer URL parsing vulnerability Vendor Notified 09 December, 2003 # Vulnerability ########## There is a flaw in the way that Internet Explorer displays URLs in the address bar. By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the current location. # Exploit ########## By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character. Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. # POC ########## http://www.zapthedingbat.com/security/ex01/vun1.htm # Tested ########## Internet Explorer Version 6.0.2800.1106C0 Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145 # Credit ########## Zap The Dingbat http://www.zapthedingbat.com/
-- Tiago Pierezan Camargo Software Engineer Telenova Research and Development Centre +55 51 33280636 ext. 222 www.telenova.net
Current thread:
- Internet Explorer URL parsing vulnerability bugtraq (Dec 09)
- Re: Internet Explorer URL parsing vulnerability Nick FitzGerald (Dec 10)
- Re: Internet Explorer URL parsing vulnerability nesumin (Dec 23)
- <Possible follow-ups>
- Re: Internet Explorer URL parsing vulnerability soulshok (Dec 09)
- Message not available
- Re: Internet Explorer URL parsing vulnerability Eric "MightyE" Stevens (Dec 09)
- Message not available
- Internet Explorer URL parsing vulnerability John W. Noerenberg II (Dec 09)
- Re: Internet Explorer URL parsing vulnerability Pedro Castro (Dec 10)
- Re: Internet Explorer URL parsing vulnerability William Stockall (Dec 10)
- Re: Internet Explorer URL parsing vulnerability Andreas Plesner Jacobsen (Dec 10)
- Re: Internet Explorer URL parsing vulnerability Charles Richmond (Dec 11)
- Re: Internet Explorer URL parsing vulnerability Tiago Pierezan Camargo (Dec 10)
- Re: Internet Explorer URL parsing vulnerability Pedro Castro (Dec 10)