BID:31616

Microsoft Internet Explorer Event Handling Cross Domain Security Bypass Vulnerability

Info

Microsoft Internet Explorer Event Handling Cross Domain Security Bypass Vulnerability

Bugtraq ID:	31616
Class:	Origin Validation Error
CVE:	CVE-2008-3473
Remote:	Yes
Local:	No
Published:	Oct 14 2008 12:00AM
Updated:	Oct 24 2008 02:16PM
Credit:	Gregory Rubin
Vulnerable:	Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Peri Workstation 0 Nortel Networks Peri Application 0 Nortel Networks Media Processing Svr 500 Rel 3.0 Nortel Networks Media Processing Svr 1000 Rel 3.0 Nortel Networks Media Processing Svr 100 0 Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1002rp Microsoft Internet Explorer 7.0 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium 0 + Microsoft Windows Server 2003 Itanium 0 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 for Itanium-based Systems 0 + Microsoft Windows Server 2008 for Itanium-based Systems 0 + Microsoft Windows Server 2008 for Itanium-based Systems 0 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems R2 + Microsoft Windows Server 2008 for x64-based Systems R2 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista SP1 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition Sp1 X64 + Microsoft Windows Vista Home Basic 64-bit edition Sp1 X64 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 + Microsoft Windows Vista x64 Edition 0 + Microsoft Windows Vista x64 Edition 0 + Microsoft Windows Vista x64 Edition Service Pack 2 0 + Microsoft Windows XP 0 + Microsoft Windows XP 0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP3 + Microsoft Windows XP Professional x64 Edition SP3 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition + Microsoft Windows XP Professional x64 Edition + Microsoft Windows XP Service Pack 3 0 + Microsoft Windows XP Service Pack 3 0 + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP3 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I

Not Vulnerable:

Discussion

Microsoft Internet Explorer Event Handling Cross Domain Security Bypass Vulnerability

Microsoft Internet Explorer is prone to a cross-domain security-bypass vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to execute arbitrary script code in another browser window's security zone. This may allow attackers to steal cookie-based authentication credentials and launch other attacks.

NOTE: Attackers exploiting this issue on Internet Explorer 6 SP1 running on Microsoft Windows 2000 SP4 may leverage the issue to execute remote code. Other vulnerable versions of the browser are prone only to information disclosure.

Exploit / POC

Microsoft Internet Explorer Event Handling Cross Domain Security Bypass Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.

Solution / Fix

Microsoft Internet Explorer Event Handling Cross Domain Security Bypass Vulnerability

Solution:
Microsoft released an advisory along with fixes to address this issue. Please see the references for more information.

Microsoft Internet Explorer 6.0 SP1

Microsoft Cumulative Security Update for Internet Explorer 6 SP1 (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=02390258-08E9 -4B75-960D-BE081B749558&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=AE8D22D5-20AA -471D-A423-F54C9D75FEBE&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=07FC88C4-2571 -4A4D-B573-AE576798AB4C&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows XP (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=A7F0F47B-B1EE -4516-9FBF-BF8E579963D0&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows XP x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=234C05FB-988B -4E02-AAB6-BB23E447DF3D&displaylang=en

Microsoft Internet Explorer 7.0

Microsoft Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=FEAF2ADF-7892 -4DBF-A147-DB4D5DBE52F3&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=319DBA34-07CA -47F9-A1E9-20DF2DF7966B&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer 7 for Windows XP (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=4E73DE2B-05E6 -4901-9BAC-46D8F469E635&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Server 2008 (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=EC73F416-2204 -42D6-8932-C96578AC819F&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Server 2008 x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=BAACD1C2-9764 -4FEA-BD4D-C49791974FEF&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Vista (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=4756E04B-6E1C -4D78-A3C0-17F6B4B97975&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Vista x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=BD19C72B-4F83 -47AB-93BE-D2C286E732C4&displaylang=en

Microsoft Internet Explorer 6.0

Microsoft Cumulative Security Update for Internet Explorer 6 SP1 (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=02390258-08E9 -4B75-960D-BE081B749558&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=AE8D22D5-20AA -471D-A423-F54C9D75FEBE&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=07FC88C4-2571 -4A4D-B573-AE576798AB4C&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows XP (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=A7F0F47B-B1EE -4516-9FBF-BF8E579963D0&displaylang=en

Microsoft Cumulative Security Update for Internet Explorer for Windows XP x64 Edition (KB956390)
http://www.microsoft.com/downloads/details.aspx?familyid=234C05FB-988B -4E02-AAB6-BB23E447DF3D&displaylang=en

References

Microsoft Internet Explorer Event Handling Cross Domain Security Bypass Vulnerability

References:

Internet Explorer Homepage (Microsoft)
Microsoft Security Bulletin MS08-058 (Microsoft )
Nortel Response to Microsoft Security Bulletin MS08-058 (Nortel Networks)