CVE-2003-0816 Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU...
- Published
- Updated
- Exploit status
- Public exploit available
Description
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp3 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20030910 MSIE->RefBack mailing-list
- 20030910 MSIE->NAFjpuInHistory mailing-list
- 20030910 MSIE->WsFakeSrc mailing-list
- 20030910 MSIE->WsOpenFileJPU mailing-list
- 20030910 MSIE->WsBASEjpu mailing-list
- 20030910 MSIE->BackMyParent2:Multi-Thread version mailing-list
- 10192 third-party-advisory
- 1007687 vdb-entry
- 20030910 MSIE->WsOpenJpuInHistory mailing-list
- VU#652452 patch third-party-advisory us-government-resource
- VU#771604 third-party-advisory us-government-resource
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- www.safecenter.net
- 20030910 MSIE->NAFfileJPU mailing-list
- 20030911 LiuDieYu's missing files are here. mailing-list
- MS03-048 vendor-advisory
- oval:org.mitre.oval:def:361 signature vdb-entry
- oval:org.mitre.oval:def:362 signature vdb-entry
- oval:org.mitre.oval:def:363 signature vdb-entry
- oval:org.mitre.oval:def:409 signature vdb-entry
- oval:org.mitre.oval:def:416 signature vdb-entry
- oval:org.mitre.oval:def:459 signature vdb-entry
- oval:org.mitre.oval:def:479 signature vdb-entry