Bugtraq mailing list archives
Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE)
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Wed, 13 Oct 2004 10:43:22 +1300
GreyMagic Security wrote: <<snip>>
Solution: ========= Microsoft was first informed on 18 Feb 2002, a patch was finally released on 22 Aug 2002 after a long investigation and testing period. The patch may be downloaded from: http://www.microsoft.com/technet/security/bulletin/ms02-047.asp. ** Update - 9 Oct 2004 ** There has been a regression in Internet Explorer that causes it to be vulnerable to this issue once again. The regression was spotted by Georgi Guninski in an advisory from 7-Oct-2004 (http://www.guninski.com/where_do_you_want_billg_to_go_today_1.html). Interestingly enough, the regression is only visible when the <script> block is introduced as static HTML in the page, dynamic blocks (via document.write) are protected. Disable Active Scripting in order to protect yourself from this vulnerability.
This is far from the first time that MS has "fixed" a vulnerability by addressing the specific form presented in a PoC or used in some "in the wild" exploit, rather than by looking into the true underlying problem. I'd be very surprised if many more such regressions are not present in IE, but it's be a rather dull job testing for them all. Of course, one of the reasons folk pay the "Windows tax" is for MS to do that dull, largely thankless and unseen (if done properly) work, on their behalf... -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854
Current thread:
- Regression in IE: Accessing remote/local content in IE (GM#009-IE) GreyMagic Security (Oct 12)
- Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE) Nick FitzGerald (Oct 12)