IE 5.5 Cross Frame security vulnerability - Web Browser Control's Navigate method

Georgi Guninski security advisory 20, 2000 IE 5.5 Cross Frame security vulnerability - Web Browser Control's Navigate method Systems affected: IE 5.5/Win98. Probably other versions - have not tested. Risk: High Date: 4 September 2000 Legal Notice: This Advisory is Copyright c 2000 Georgi Guninski...

CVE-2000-0503

The IFRAME of the WebBrowser control in Internet Explorer 5.01 allows a remote attacker to violate the cross frame security policy via the NavigateComplete2 event...

CVE-2000-0465

Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files via the frame, aka the "Frame Domain Verification" vulnerability...

CVE-2000-0404

The CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the "ResetBrowser Frame" vulnerability...

CVE-2000-0503

The CVE-2000-0503 entry concerns the IFRAME within the WebBrowser control of Internet Explorer 5.01. The issue allows a remote attacker to violate the cross-frame security policy via the NavigateComplete2 event. The description and connected records indicate the vulnerability is tied to the WebBr...

CVE-2000-0404

The CVE-2000-0404 issue affects the CIFS Computer Browser service and allows remote denial of service by sending a ResetBrowser frame to the Master Browser ("ResetBrowser Frame" vulnerability). Connected sources confirm the vulnerability impact is a network-denial of service and describe two rela...

CVE-2000-0465

Affected software: Internet Explorer 4.x and 5.x. Vulnerability: Frame Domain Verification — IE does not properly verify the domain of a frame within a browser window. Root cause/summary: Inadequate domain verification enables a remote attacker to access client files via the frame. Impact: Confid...

CVE-2000-0404: Undefined Security Weakness

The CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the "ResetBrowser Frame" vulnerability...

CVE-2000-0465: Undefined Security Weakness

Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files via the frame, aka the "Frame Domain Verification" vulnerability...

CVE-2000-0503: Undefined Security Weakness

The IFRAME of the WebBrowser control in Internet Explorer 5.01 allows a remote attacker to violate the cross frame security policy via the NavigateComplete2 event...

CVE-2000-0403: Undefined Security Weakness

The CIFS Computer Browser service on Windows NT 4.0 allows a remote attacker to cause a denial of service by sending a large number of host announcement requests to the master browse tables, aka the "HostAnnouncement Flooding" or "HostAnnouncement Frame" vulnerability...

ie-iframe.txt

Georgi Guninski security advisory 12, 2000 IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser control Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski...

IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser control

Georgi Guninski security advisory 12, 2000 IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser control Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski...

CVE-2000-0503

The IFRAME of the WebBrowser control in Internet Explorer 5.01 allows a remote attacker to violate the cross frame security policy via the NavigateComplete2 event...

CVE-2000-0404

The CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the "ResetBrowser Frame" vulnerability...

Security Bulletin (MS00-033)

Microsoft Security Bulletin MS00-033 - -------------------------------------- Patch Available for "Frame Domain Verification", "Unauthorized Cookie Access", and "Malformed Component Attribute" Vulnerabilities Originally Posted: May 17, 2000 Summary ======= Microsoft has released a comprehensive...

CVE-2000-0465

Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files via the frame, aka the "Frame Domain Verification" vulnerability...

Microsoft Internet Explorer 4.0/5.0/5.5 preview/5.0.1 - DocumentComplete() Cross Frame Access

source: https://www.securityfocus.com/bid/1224/info The DocumentComplete function in IE does not properly validate origin domains. Therefore it is possible for a remote webserver to gain read access to local files on the machine of any website visitor or email recipient by accessing the browser...

CVE-2000-0266

The CVE-2000-0266 entry describes a vulnerability in Internet Explorer 5.01 where a malicious applet can bypass the cross-frame security policy by interacting with the Java JSObject to modify DOM properties, allowing an IFRAME to load an arbitrary JavaScript URL. This reveals a client-side cross-...

CVE-2000-0266

Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL...