Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
(Microsoft Issues Warning and Describes a Workaround) Microsoft Internet Explorer Has Fixed Security Zone for about: URLs and Has Shared Cookie Flaw That Diminishes Cross-Site Scripting Protections
SecurityTracker Alert ID: 1002718|
SecurityTracker URL: http://securitytracker.com/id/1002718
(Links to External Site)
Date: Nov 9 2001
Execution of arbitrary code via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): IE 5.5, IE 6.0|
A vulnerability was reported in Microsoft Internet Explorer (IE). It is reported that the "about:" URL is always considered part of the Internet security zone and that it has a shared global cookie flaw that allows different sites to access "about:" page cookies. This could facilitate cross-site scripting attacks.|
If a remote web site or HTML-based e-mail includes a link to an "about:" page that is not known to IE, the browser will echo the "about:" string exactly on the page. All "about:" pages are reportedly considered to be in the browser's Internet Zone. As a result, web sites in the Restricted Zone can link to an "about:" page to inject malicious scripting content that would not otherwise be permitted and cause the code to be executed on the browser.
In addition, cookies can be stored for "about:" pages in IE 5.5 and IE 6. Due to a flaw in the way IE parses "about:" URLs, different sites can pass shared cookies. It is reported that IE incorrectly applies HTTP-style URL parsing to "about:" URLs such that a URL that contains a "?" character is only analyzed up to the "?" character when determining uniqueness of the URL. So, any URL that begins with "about:?" will be considered to be the same URL in determining cookie access.
A demonstration exploit is described in the Source Message. The author of the report notes that only IE5.5 and IE6 were able to store cookies for "about:" pages, so the exploit did not work on IE4 and IE5.0.
The author of the report also notes that this may be considered a "minor vulnerability."
A malicious web page with a malformed URL could read the contents of a user s cookie which might contain sensitive information. The malicious web page could potentially alter the contents of the cookie. This URL could be embedded within a web page or delivered via HTML-based e-mail.|
The vendor has issued a warning and provided a workaround while a patch is being prepared. The patch will be posted as soon as it is available.|
Microsoft recommends that customers consider disabling active scripting in the Internet Zone and the Intranet Zone and that customers using Outlook Express (OE) who have not set OE to use the "Restricted Sites" Zone should do so.
Microsoft reports that users who have applied the Outlook Email Security Update (http://office.microsoft.com/downloads/2000/Out2ksec.aspx) are not susceptible to the HTML-based e-mail exploit of this vulnerability.
To disable active scripting in Internet Explorer 5.5 and 6.0, uses can use the Tools menu to click Internet Options, click the Security tab, and then click Custom Level. In the Settings box, users can scroll down to the Scripting section and click Disable under "Active scripting" and "Scripting of Java applets". To accept the new settings, click OK and then click OK again.
Microsoft describes how network administrators can disable active scripting across their enterprise using IEAK before rolling the configuration out to users. See the Vendor URL for the Microsoft Advisory containing directions on how to do this.
Vendor URL: www.microsoft.com/technet/security/bulletin/MS01-055.asp (Links to External Site)
Windows (Me), Windows (NT), Windows (95), Windows (98), Windows (2000)|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Date: Thu, 8 Nov 2001 18:14:27 -0800|
Subject: Microsoft Security Bulletin MS01-055
The following is a Security Bulletin from the Microsoft Product Security
Please do not reply to this message, as it was sent from an unattended
-----BEGIN PGP SIGNED MESSAGE-----
Title: Cookie Data in IE Can Be Exposed or Altered
Through Script Injection
Date: 08 November 2001
Software: Internet Explorer
Impact: Exposure and altering of data in cookies
Max Risk: High
Microsoft encourages customers to review the Security Bulletin at:
local system. Most often, this information is used for customizing
and retaining a site's setting for a user across multiple sessions.
By design each site should maintain its own cookies on a user's
machine and be able to access only those cookies.
A vulnerability exists because it is possible to craft a URL that
can allow sites to gain unauthorized access to user's cookies and
potentially modify the values contained in them. Because some web
sites store sensitive information in a user's cookies, it is also
possible that personal information could be exposed.
Microsoft is preparing a patch for this issue, but in the meantime
customers can protect their systems by disabling active
scripting. (The FAQ provides step-by-step instructions for doing
this). This will protect against both the web-hosted and the
mail-borne variants discussed above. When the patch is complete,
Microsoft will re-release this bulletin and provide details on
obtaining and using it.
- A user must first be enticed to a malicious web site or to
open an HTML e-mail containing the malformed URL.
- Users who have applied the Outlook Email Security Update
are not affected by the HTML mail exploit of this
- Users who have set Outlook Express to use the "Restricted
Sites" Zone are not affected by the HTML mail exploit of this
vulnerability because the "Restricted Sites" zone sets Active
Scripting to disabled. Note that this is the default setting
for Outlook Express 6.0. Users of Outlook Express 6.0 should
verify that Active Scripting is still disabled in the Restricted
- Internet systems: High
- Intranet systems: High
- Client systems: High
- A patch is currently under development. A work-around is
available to mitigate this vulnerability. Please read the
Security Bulletin at
for information on obtaining this patch.
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE
FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO
THE FOREGOING LIMITATION MAY NOT APPLY.
-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1
-----END PGP SIGNATURE-----
You have received this e-mail bulletin as a result of your registration
to the Microsoft Product Security Notification Service. You may
unsubscribe from this e-mail notification service at any time by sending
an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.
To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.
For more information on the Microsoft Security Notification Service
please visit http://www.microsoft.com/technet/security/notify.asp. For
security-related information about Microsoft products, please visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.
Go to the Top of This SecurityTracker Archive Page