Vulnerability Note VU#516627

Microsoft Internet Explorer fails to properly restrict access to frames

Microsoft Internet Explorer fails to properly restrict access to a document's frames. This can allow an attacker to replace the contents of a web page's frame with arbitrary content. Internet Explorer still appears to enforce the cross-domain security model, which limits the actions that a malicious frame can take with the parent document. For example, a frame that exists in a different domain should not be able to access the parent document's cookies or HTML content, or other domain-specific DOM components. However, components that are not tied to a specific domain, such as the onmousedown event can be accessed. By monitoring this particular event, an IFRAME can capture keystrokes from the parent document. Other actions may be possible.

Limited testing has shown that Internet Explorer 6, 7, and 8 beta 1 are vulnerable. Proof-of-concept code for this vulnerability is publicly available.

II. Impact

Disable Active Scripting

This vulnerability can be mitigated by disabling Active Scripting in the Internet Zone, as specified in the "Securing Your Web Browser" document.

Systems Affected

http://www.gnucitizen.org/blog/ghost-busters/
http://sirdarckcat.blogspot.com/2008/05/ghosts-for-ie8-and-ie75730.html
http://sirdarckcat.blogspot.com/2008/05/browsers-ghost-busters.html
http://secunia.com/advisories/30851/
http://www.w3.org/TR/REC-html40/present/frames.html
http://msdn.microsoft.com/en-us/library/ms537026(VS.85).aspx

Credit

This vulnerability was publicly disclosed by Eduardo Vela.

This document was written by Will Dormann.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.