IE 5 security vulnerablity - circumventing Cross-frame security policy using Java/JavaScript (and disabling Active Scripting is not that easy)

Georgi Guninski security advisory 10, 2000 IE 5 security vulnerablity - circumventing Cross-frame security policy using Java/JavaScript and disabling Active Scripting is not that easy Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual...

CVE-2000-0266

Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL...

CVE-1999-0488

Internet Explorer 4.0 and 5.0 allows a remote attacker to execute security scripts in a different security context using malicious URLs, a variant of the "cross frame" vulnerability...

CVE-2000-0028

Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function...

CVE-1999-0827

By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across different domains" option, which allows frame spoofing...

CVE-1999-0827

The CVE affects Internet Explorer 5.0 (and other versions) where the default setting for the option “Navigate sub-frames across different domains” is enabled, enabling frame spoofing. Root cause: the feature is on by default, allowing sub-frame navigation across domains and exposing partial confi...

CVE-1999-0488

CVE-1999-0488 affects Internet Explorer 4.0 and 5.0. The vulnerability is a variant of the “cross frame” issue that allows a remote attacker to execute security scripts in a different security context via malicious URLs. The description indicates this is a remote code execution-style weakness thr...

raq2.admin.exploit.txt

To replicate this bug you must have Site Administrator access to one of the accounts on the server. When you go into the Site Management for a site and select the User Management option, you get a list of the usernames that have been setup for that account. The green pencil edit icon is a command...

ie5.cross-frame.txt

Georgi Guninski security advisory 4, 2000 IE 5 security vulnerablity - circumventing Cross-frame security policy and accessing the DOM of "old" documents. Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies,...

CVE-1999-0871

Internet Explorer 4.0 and 4.01 allow a remote attacker to read files via IE's cross frame security, aka the "Cross Frame Navigate" vulnerability...

CVE-1999-0869

Internet Explorer 3.x to 4.01 allows a remote attacker to insert malicious content into a frame of another web site, aka frame spoofing...

CVE-1999-0871

The vulnerability CVE-1999-0871 affects Internet Explorer 4.0 and 4.01, described as the "Cross Frame Navigate" issue where a remote attacker can read files due to IE’s cross-frame security. The provided documents identify the affected product and the basic impact (read access to files) but do no...

CVE-1999-0869

The vulnerability (CVE-1999-0869) affects Internet Explorer 3.x to 4.01. It allows a remote attacker to insert malicious content into a frame of another web site (frame spoofing). No remediation or exploitation details are provided in the connected documents.

CVE-2000-0028

Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function...

PT-1999-1837 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 5.0 through 5.01 Description: The issue allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function. Recommendations: For Internet Explorer versions 5.0...

Microsoft Internet Explorer 4/5/5.5/5.0.1 - external.NavigateAndFind() Cross-Frame

Microsoft Internet Explorer 4.0 for WfW/Windows 3.1/Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5,Internet Explorer 5.0.1,Internet Explorer for Unix 5.0 external.NavigateAndFind Cross-Frame Vulnerability source...

Microsoft Internet Explorer 455.55.0.1 - external.NavigateAndFind() Cross-Frame

Microsoft Internet Explorer 455.55.0.1 - external.NavigateAndFind Cross-Frame Microsoft Internet Explorer 4.0 for WfW/Windows 3.1/Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5,Internet Explorer 5.0.1,Internet...

ie.frameloop.txt

Microsoft Internet Explorer 4.x 5.x - Frame Loop Vulnerability PROBLEM: It is possible to create a malicious webpage that when visited by an IE user all of their system resources are devoured and depending on the system its possible that the machine can even crash and reboot itself. The reason yo...

ie50.frame-spoofing.txt

ult IE 5.0 security settings allow frame spoofing Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for any damages caused by direct or indirect use of th...

CVE-1999-0827

By default, Internet Explorer 5.0 and other versions enables the "Navigate sub-frames across different domains" option, which allows frame spoofing...