[36894] in bugtraq
Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE)
daemon@ATHENA.MIT.EDU (Nick FitzGerald)
Tue Oct 12 19:28:56 2004
Date: Wed, 13 Oct 2004 10:43:22 +1300
From: Nick FitzGerald <nick@virus-l.demon.co.uk>
In-reply-to: <20041012165143.E979033B24@sa10.bezeqint.net>
To: bugtraq@securityfocus.com
Reply-To: nick@virus-l.demon.co.uk
Message-id: <416D06CA.7901.322B971@localhost>
MIME-version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
GreyMagic Security wrote:
<<snip>>
> Solution:
> =========
>
> Microsoft was first informed on 18 Feb 2002, a patch was finally released on
> 22 Aug 2002 after a long investigation and testing period.
>
> The patch may be downloaded from:
> http://www.microsoft.com/technet/security/bulletin/ms02-047.asp.
>
> ** Update - 9 Oct 2004 **
>
> There has been a regression in Internet Explorer that causes it to be
> vulnerable to this issue once again. The regression was spotted by Georgi
> Guninski in an advisory from 7-Oct-2004
> (http://www.guninski.com/where_do_you_want_billg_to_go_today_1.html).
>
> Interestingly enough, the regression is only visible when the <script> block
> is introduced as static HTML in the page, dynamic blocks (via
> document.write) are protected.
>
> Disable Active Scripting in order to protect yourself from this
> vulnerability.
This is far from the first time that MS has "fixed" a vulnerability by
addressing the specific form presented in a PoC or used in some "in the
wild" exploit, rather than by looking into the true underlying problem.
I'd be very surprised if many more such regressions are not present in
IE, but it's be a rather dull job testing for them all.
Of course, one of the reasons folk pay the "Windows tax" is for MS to
do that dull, largely thankless and unseen (if done properly) work, on
their behalf...
--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854
