Web browsers running the Apple QuickTime plugin may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine.
Web browser plugins that allow remote web sites to reference content that resides on the local filesystem may be vulnerable to cross-domain security violations. In a typical attack scenario, an attacker must first place content in a known or predictable location on a computer. If a web browser plugin allows a remote web site to reference that content, this may allow attacker-supplied script to run within the security context of the local machine.
The Apple QuickTime plugin running in Microsoft Internet Explorer or Apple Safari fails to restrict web sites from accessing content on the local filesystem. Current proof-of-concept exploit code uses the HREFTrack attribute to exploit a cross-site scripting vulnerability in a file on Windows systems.
A remote, unauthenticated attacker may be able to execute script within the security context of the local machine. Script that executes within this context may be able to perform privileged actions, such as reading files from the local filesystem. These actions would not be possible by using script that executes within the security context of the remote web site.
This issue was reported by GNUCITIZEN.
This document was written by Chris Taschner.
|Date First Published:||2007-01-12|
|Date Last Updated:||2007-03-19 17:24 UTC|