[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Off topic: Outlook Express 5 vulnerability



PureBytes Links

Trading Reference Links

The topic of computer security comes up here from time to time, and Georgi
Guninski's work has been mentioned too.  Here's the latest:


----- Original Message -----
From: Georgi Guninski <joro@xxxxxx>
To: <BUGTRAQ@xxxxxxxxxxxxxxxxx>
Sent: February 1, 2000 05:48
Subject: Outlook Express 5 vulnerability - Active Scripting may read email
messages

Georgi Guninski security advisory #6, 2000

Outlook Express 5 vulnerability - Active Scripting may read email messages

Disclaimer:
The opinions expressed in this advisory and program are my own and not of
any company. The usual standard disclaimer applies, especially the fact that
Georgi Guninski is not liable for any damages caused by direct or  indirect
use of the information or functionality provided by this program. Georgi
Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.

Description:
Outlook Express 5.01 and Internet Explorer 5.01 under Windows 95 (suppose
other versions are also vulnerable) allow reading subsequently opened email
messages after a hostile message is opened.

Details:
The problem is assigning the document object of the email message to a
variable in a newly opened window. Thru this variable access is possible to
open email messages.

The code that must be included in HTML message is :
---------------------------------------------------------------------
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click
here to see the active message</A>");
a.x=window.document;
</SCRIPT>
---------------------------------------------------------------------

Workaround: Disable Active Scripting

Regards,
Georgi Guninski
http://www.nat.bg/~joro