I cannot believe it. This is the 4th HUGE security hole in IE 6 posted to Bugtraq in the last two weeks. Microsoft has yet to fix any of them.
Class: Failure to Handle Exceptional Conditions Remote: Yes Local: Yes Found: December 19, 2001 Severity: High Vulnerable: IE 6.0.2600.0000 + Windows 2000 Update Versions: Q312461; Q240308; Q313675 Discussion: By simply using the document.open method and not using the document.close method you are able to: steal cookies; read local files that are parsable by IE(mime type text/html to be exact); and spoof sites. Exploits: http://www.osioniusx.com "cookieStealing.html" - This opens Yahoo.com and steals the cookie. "FileReading.html" - This opens up C:\test.txt and then reads it. "SiteSpoofing.html" - This spoofs www.chase.com -- chase.com is in the url, the title, and there is a link on the page to log on to your account which comes back to www.osioniusx.com. Potential Solution: Fix required on document.open method. Vendor Status: Emailed to "[EMAIL PROTECTED]". ______________________________________________________________________ Your ad could be here. Monies from ads go to support these lists and provide more resources for the community. http://www.fusionauthority.com/ads.cfm Archives: http://www.mail-archive.com/[email protected]/ Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
