Maxthon Web Browser Cross-Domain Dialog Box Spoofing Vulnerability

Bugtraq ID:	11470
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 20 2004 12:00AM
Updated:	Oct 20 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Jakob Balle of Secunia Research.
Vulnerable:	Maxthon MyIE2 0.9.27 Maxthon Maxthon 1.1.39
Not Vulnerable:

Maxthon Web Browser Cross-Domain Dialog Box Spoofing Vulnerability

Maxthon web browser is reported prone to a cross-domain dialog box spoofing vulnerability. This issue may allow a remote attacker to carry out phishing style attacks as an attacker may exploit this vulnerability to spoof the interface of a trusted web site.

Maxthon Web Browser Cross-Domain Dialog Box Spoofing Vulnerability

An exploit is not required.

A proof of concept is available from the following location:

http://secunia.com/multiple_browsers_dialog_box_spoofing_test/

Maxthon Web Browser Cross-Domain Dialog Box Spoofing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Maxthon Web Browser Cross-Domain Dialog Box Spoofing Vulnerability

References:

• Maxthon Homepage (Maxthon)
  
• Multiple Browsers Tabbed Browsing Vulnerabilities (Secunia)