Guidance on Internet Explorer XSS Filter

ronjor · Apr 20, 2010

The XSS Filter related Blackhat EU presentation discussed a vulnerability that was previously disclosed and addressed in the January security update to Internet Explorer (MS10-002). This attack scenario involved modified HTTP responses, enabling XSS on sites that would not otherwise be vulnerable.

An additional update to the IE XSS Filter is currently scheduled for release in June. This change will address a SCRIPT tag attack scenario described in the Blackhat EU presentation. This issue manifests when malicious script can “break out” from within a construct that is already within an existing script block. While the issue identified and addressed in MS10-002 was identified to exist on high-profile web sites, thus far real-world examples of the SCRIPT tag neutering attack scenario have been hard to come by.
Click to expand...

Microsoft

MrBrian · Apr 20, 2010

Security gone awry: IE 8 XSS filter exposes sites to XSS attacks

The cross-site scripting filter that ships with Microsoft’s Internet Explorer 8 browser can be abused by attackers to launch cross-site scripting attacks on websites and web pages that would otherwise be immune to this threat.

According to a presentation at this year’s Black Hat Europe conference, the issue introduces security problems at several high-profile websites, including Microsoft’s own Bing.com, Google.com, Wikipedia.org, Twitter.com and just about any site that lets IE 8 users create profiles.
Click to expand...

Log in or Sign up

Guidance on Internet Explorer XSS Filter

ronjor Global Moderator

MrBrian Registered Member

Log in or Sign up

Guidance on Internet Explorer XSS Filter

ronjor Global Moderator

MrBrian Registered Member

Useful Searches