We browsers vulnerability

Discussion in 'other security issues & news' started by Paul Wilders, Feb 9, 2002.

Thread Status:
Not open for further replies.
  1. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    Web Browsers vulnerable to the Extended HTML Form Attack

    Release Date: 06/02/2002
    Effects: Internet Explorer 6 and older versions / Opera 6.0 and older versions

    Severity:
    Allows stealing of cookies, penetration of internal networks and other evil stuff.

    Author:
    Obscure^

    Vendor Status:
    Internet Explorer - Informed secure@microsoft.com and worked with them to release a patch. Should be out soon.
    Opera - Worked with the Opera team. A fix is due next release.

    Web:

    http://eyeonsecurity.net/papers/ - Extended HTML Form Attack

    Background.

    Many web browsers such as Internet Explorer allow forms to be submitted to non-HTTP services. Some non-HTTP services echo back the information sent, and the web browser renders the echo as an HTML page, regardless of the protocol behind the service.

    Problem.

    A malicious user can create a form which is submitted by the victim (automatically using Active Scripting or manually using Social Engineering). This form can cause a non-HTTP service to echo back JavaScript commands which in turn allow the malicious user to steal the cookie for that domain. There are more uses for this attack, other than just stealing cookies.

    Exploit Example.

    available at http://eyeonsecurity.net/advisories/showMyCookie.html

    Disclaimer.

    The information within this document may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any consequences whatsoever arising out of or in connection with the use or spread of this information. Any use of this information lays within the user's responsibility.

    ----

    regards.

    paul
     
  2. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Paul - Do you remember what that link was where you could d/l the most up-to-date beta of Opera? I can't find it. Pete
     
  3. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    You'll find it over here:

    http://www.opera.com/download/

    FYI: the pulled a version back; available now is version 6.0.1010

    regards.

    paul
     
  4. *Ari*

    *Ari* Registered Member

    Joined:
    Feb 15, 2002
    Posts:
    431
    Location:
    Finland
    Howdy Paul

    Opera is working extremely fine for me together win 98, and with configured virtual memory. Opera needs some extra RAM for cache files.
    And with Cookie Muncher it´s security is even better. Java is disabled too. Still never knows.....

    -Ari
     
Loading...
Thread Status:
Not open for further replies.