SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Browser)  >   Microsoft Internet Explorer (IE) Vendors:   Microsoft
(Microsoft Issues Warning and Describes a Workaround) Microsoft Internet Explorer Has Fixed Security Zone for about: URLs and Has Shared Cookie Flaw That Diminishes Cross-Site Scripting Protections
SecurityTracker Alert ID:  1002718
SecurityTracker URL:  http://securitytracker.com/id/1002718
CVE Reference:   CAN-2001-0722   (Links to External Site)
Date:  Nov 9 2001
Impact:   Execution of arbitrary code via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): IE 5.5, IE 6.0
Description:   A vulnerability was reported in Microsoft Internet Explorer (IE). It is reported that the "about:" URL is always considered part of the Internet security zone and that it has a shared global cookie flaw that allows different sites to access "about:" page cookies. This could facilitate cross-site scripting attacks.

If a remote web site or HTML-based e-mail includes a link to an "about:" page that is not known to IE, the browser will echo the "about:" string exactly on the page. All "about:" pages are reportedly considered to be in the browser's Internet Zone. As a result, web sites in the Restricted Zone can link to an "about:" page to inject malicious scripting content that would not otherwise be permitted and cause the code to be executed on the browser.

In addition, cookies can be stored for "about:" pages in IE 5.5 and IE 6. Due to a flaw in the way IE parses "about:" URLs, different sites can pass shared cookies. It is reported that IE incorrectly applies HTTP-style URL parsing to "about:" URLs such that a URL that contains a "?" character is only analyzed up to the "?" character when determining uniqueness of the URL. So, any URL that begins with "about:?" will be considered to be the same URL in determining cookie access.

A demonstration exploit is described in the Source Message. The author of the report notes that only IE5.5 and IE6 were able to store cookies for "about:" pages, so the exploit did not work on IE4 and IE5.0.

The author of the report also notes that this may be considered a "minor vulnerability."

Impact:   A malicious web page with a malformed URL could read the contents of a user s cookie which might contain sensitive information. The malicious web page could potentially alter the contents of the cookie. This URL could be embedded within a web page or delivered via HTML-based e-mail.
Solution:   The vendor has issued a warning and provided a workaround while a patch is being prepared. The patch will be posted as soon as it is available.

Microsoft recommends that customers consider disabling active scripting in the Internet Zone and the Intranet Zone and that customers using Outlook Express (OE) who have not set OE to use the "Restricted Sites" Zone should do so.

Microsoft reports that users who have applied the Outlook Email Security Update (http://office.microsoft.com/downloads/2000/Out2ksec.aspx) are not susceptible to the HTML-based e-mail exploit of this vulnerability.

To disable active scripting in Internet Explorer 5.5 and 6.0, uses can use the Tools menu to click Internet Options, click the Security tab, and then click Custom Level. In the Settings box, users can scroll down to the Scripting section and click Disable under "Active scripting" and "Scripting of Java applets". To accept the new settings, click OK and then click OK again.

Microsoft describes how network administrators can disable active scripting across their enterprise using IEAK before rolling the configuration out to users. See the Vendor URL for the Microsoft Advisory containing directions on how to do this.

Vendor URL:  www.microsoft.com/technet/security/bulletin/MS01-055.asp (Links to External Site)
Cause:   State error
Underlying OS:   Windows (Me), Windows (NT), Windows (95), Windows (98), Windows (2000)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 20 2001 Microsoft Internet Explorer Has Fixed Security Zone for about: URLs and Has Shared Cookie Flaw That Diminishes Cross-Site Scripting Protections



 Source Message Contents

Date:  Thu, 8 Nov 2001 18:14:27 -0800
Subject:  Microsoft Security Bulletin MS01-055


The following is a Security  Bulletin from the Microsoft Product Security
Notification Service.

Please do not  reply to this message,  as it was sent  from an unattended
mailbox.
                    ********************************

-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------
Title:      Cookie Data in IE Can Be Exposed or Altered
            Through Script Injection
Date:       08 November 2001
Software:   Internet Explorer
Impact:     Exposure and altering of data in cookies
Max Risk:   High
Bulletin:   MS01-055

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-055.asp.
- ----------------------------------------------------------------------

Issue:
======
Web sites use cookies as a way to store information on a user's
local system. Most often, this information is used for customizing
and retaining a site's setting for a user across multiple sessions.
By design each site should maintain its own cookies on a user's
machine and be able to access only those cookies. 

A vulnerability exists because it is possible to craft a URL that
can allow sites to gain unauthorized access to user's cookies and
potentially modify the values contained in them. Because some web
sites store sensitive information in a user's cookies, it is also
possible that personal information could be exposed. 

Microsoft is preparing a patch for this issue, but in the meantime
customers can protect their systems by disabling active
scripting. (The FAQ provides step-by-step instructions for doing
this). This will protect against both the web-hosted and the
mail-borne variants discussed above. When the patch is complete,
Microsoft will re-release this bulletin and provide details on
obtaining and using it. 

Mitigating Factors:
====================
 - A user must first be enticed to a malicious web site or to
   open an HTML e-mail containing the malformed URL.
 
 - Users who have applied the Outlook Email Security Update
   are not affected by the HTML mail exploit of this
   vulnerability. 

 - Users who have set Outlook Express to use the "Restricted
   Sites" Zone are not affected by the HTML mail exploit of this
   vulnerability because the "Restricted Sites" zone sets Active
   Scripting to disabled. Note that this is the default setting
   for Outlook Express 6.0. Users of Outlook Express 6.0 should
   verify that Active Scripting is still disabled in the Restricted
   Sites Zone. 

Risk Rating:
============
 - Internet systems: High
 - Intranet systems: High
 - Client systems: High

Patch Availability:
===================
 - A patch is currently under development.  A work-around is
   available to mitigate this vulnerability. Please read the 
   Security Bulletin at
   http://www.microsoft.com/technet/security/bulletin/ms01-055.asp
   for information on obtaining this patch.

- ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBO+s7240ZSRQxA/UrAQHg8gf6A9I1jKIOsGVNbl7viLQoBWbjC1aCFH8n
JtP2vFIB182ioZP0xipj9cCncGggwQeSC96xbN8mxRhCPeKUGq0QNzoqhouZ2Dcr
KzPNRDJ7+FmL9uD9m/jtCnxrUGlYtfRWs1xvhurl7IEzepP5TmxD5d5xZO/OXPzM
EIW04RrZhR0pSzvfBztOhnLg8Uac9vr0+GKIqStFJNuzExXaHve6ID0/tIK6b+er
Bslef6ctE0UJ70IEQ4uSZTAhNgWLJRI9oiFsD0aTFOCaCqxQpscT5AIxCnUL2651
uXQNGIUWGkC45Ybp5fxQBCN80mvJ80uwWiCTp7a2pSlKRSWq/b07uw==
=q7Wz
-----END PGP SIGNATURE-----

   *******************************************************************
You have received  this e-mail bulletin as a result  of your registration
to  the   Microsoft  Product  Security  Notification   Service.  You  may
unsubscribe from this e-mail notification  service at any time by sending
an  e-mail  to  MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.

To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.

For  more  information on  the  Microsoft  Security Notification  Service
please  visit  http://www.microsoft.com/technet/security/notify.asp.  For
security-related information  about Microsoft products, please  visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC