Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE)

[Nick FitzGerald <nick@xxxxxxxxxxxxxxxxxxx>]

GreyMagic Security wrote:

<<snip>>
> Solution: 
> =========
> 
> Microsoft was first informed on 18 Feb 2002, a patch was finally released on
> 22 Aug 2002 after a long investigation and testing period. 
> 
> The patch may be downloaded from:
> http://www.microsoft.com/technet/security/bulletin/ms02-047.asp.
> 
> ** Update - 9 Oct 2004 **
> 
> There has been a regression in Internet Explorer that causes it to be
> vulnerable to this issue once again. The regression was spotted by Georgi
> Guninski in an advisory from 7-Oct-2004
> (http://www.guninski.com/where_do_you_want_billg_to_go_today_1.html). 
> 
> Interestingly enough, the regression is only visible when the <script> block
> is introduced as static HTML in the page, dynamic blocks (via
> document.write) are protected. 
> 
> Disable Active Scripting in order to protect yourself from this
> vulnerability.

This is far from the first time that MS has "fixed" a vulnerability by 
addressing the specific form presented in a PoC or used in some "in the 
wild" exploit, rather than by looking into the true underlying problem. 
I'd be very surprised if many more such regressions are not present in 
IE, but it's be a rather dull job testing for them all.

Of course, one of the reasons folk pay the "Windows tax" is for MS to 
do that dull, largely thankless and unseen (if done properly) work, on 
their behalf...


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854