Reported November 22, 1999 by Georgio Guninski
According to Georgio"s bulletin, "Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (and perhaps other versions) has a security problem with HTTP redirects in XML objects. This allows at least the following actions:
When someone embeds an XML document within an HTML
document, IE 5.0 does not handle the HTTP redirects properly, allowing access to the
domain of the embeded XML document."
<object id="xm" type="text/xml"
To guard against the risks presented in this bulletin, be sure to adjust control of ActiveX Scripting, Controls, and Plugins on your IE5 Browser. To do so, choose the Tools menu, select Options, and then click the Security tab. On the dialog, choose the Internet zone, and click the Custom Level button, which opens a new dialog. On the new dialog, scroll through the list and adjust all ActiveX properties to either "Disable" or "Prompt." Keep in mind that if you set these controls to "Prompt," you may experience a large number of prompts on the screen while surfing the Internet. If the prompts become a bother, simply readjust the ActiveX properties to "Disable."
Microsoft is aware of this problem, however the vendor comment is known at the time of this writing.
Discovered by Georgio Guninski
Posted here at NTSecurity.net on November 22, 1999