Overview
Microsoft Internet Explorer (IE) does not properly determine the source of script used in URLs stored in the "Travel Log." An attacker could exploit this vulnerability to evaluate script in different security domains. By causing script to be evaluated in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE.
Description
IE uses a cross-domain security model to maintain separation between browser frames from different sources. This model is designed to prevent code in one domain from accessing data in a different domain. From Microsoft Security Bulletin MS04-004: One of the principal security functions of a browser is to ensure that browser windows that are under the control of different Web sites cannot interfere with each other or access each other's data, while allowing windows from the same site to interact with each other. To differentiate between cooperative and uncooperative browser windows, the concept of a "domain" has been created. A domain is a security boundary - any open windows within the same domain can interact with each other, but windows from different domains cannot. The cross-domain security model is the part of the security architecture that keeps windows from different domains from interfering with each other. javascript:eval('alert("Hello world.")') This URL will display an alert dialog with the contents of the HTTP cookie for the current site: javascript:alert(document.cookie) The cross-domain security model should not allow script from one domain to read or modify data in a different domain using this type of "script URL". |
Impact
By convincing a victim to view an HTML document (web page, HTML email), an attacker could evaluate script in a different security domain than the one containing the attacker's document. If the script is evaluated in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE. The attacker could also read or modify data in other web sites (read cookies/content, modify/create content, etc.). |
Solution
Apply patch |
|
Vendor Information
CVSS Metrics
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
References
- http://www.securityfocus.com/archive/1/345617
- http://www.safecenter.net/UMBRELLAWEBV4/BackToFramedJpu/BackToFramedJpu-Content.htm
- http://www.securityfocus.com/archive/1/352460
- http://www.microsoft.com/technet/security/bulletin/MS04-004.asp
- http://msdn.microsoft.com/workshop/browser/travellog/travellog.asp
- http://msdn.microsoft.com/workshop/browser/webbrowser/browser_control_ovw_entry.asp
- http://msdn.microsoft.com/workshop/author/om/xframe_scripting_security.asp
- http://msdn.microsoft.com/workshop/security/szone/overview/overview.asp#SecurityZones
- http://msdn.microsoft.com/workshop/security/szone/overview/overview.asp#default_zones
- http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/navigateandfind.asp
- http://support.microsoft.com/?kbid=307594
- http://support.microsoft.com/?kbid=291387
- http://support.microsoft.com/?kbid=831167
- http://xforce.iss.net/xforce/xfdb/13846
- http://www.securityfocus.com/bid/9109
- http://www.secunia.com/advisories/10289/
Acknowledgements
This vulnerability was publicly reported by Liu Die Yu. Thanks to Microsoft for information used in this document.
This document was written by Art Manion.
Other Information
CVE IDs: | CVE-2003-1026 |
Severity Metric: | 41.01 |
Date Public: | 2003-11-25 |
Date First Published: | 2004-02-02 |
Date Last Updated: | 2004-02-17 22:24 UTC |
Document Revision: | 39 |