search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Internet Explorer fails to properly restrict access to frames

Vulnerability Note VU#516627

Original Release Date: 2008-06-27 | Last Revised: 2008-07-15

Overview

Microsoft Internet Explorer fails to properly restrict access to a document's frames, which may allow an attacker to modify the contents of frames in a different domain.

Description

Frames in HTML documents are subdivisions of the current window. The most common use of frames in web pages is the IFRAME, or inline frame. IFRAMEs can be used to display content from a different domain within the physical representation of the current web page. A common example of the use of an IFRAME in a web page is to display a banner advertisement from a third party.

Microsoft Internet Explorer fails to properly restrict access to a document's frames. This can allow an attacker to replace the contents of a web page's frame with arbitrary content. Internet Explorer still appears to enforce the cross-domain security model, which limits the actions that a malicious frame can take with the parent document. For example, a frame that exists in a different domain should not be able to access the parent document's cookies or HTML content, or other domain-specific DOM components. However, components that are not tied to a specific domain, such as the onmousedown event can be accessed. By monitoring this particular event, an IFRAME can capture keystrokes from the parent document. Other actions may be possible.

Limited testing has shown that Internet Explorer 6, 7, and 8 beta 1 are vulnerable. Proof-of-concept code for this vulnerability is publicly available.

Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message), an attacker may be able to access non-domain-specific elements from a web page that exists in a different domain. For example, the attacker may be able to capture keystrokes while a user is interacting with a web page in a different domain.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:


Disable Active Scripting

This vulnerability can be mitigated by disabling Active Scripting in the Internet Zone, as specified in the "Securing Your Web Browser" document.

Vendor Information

516627
 
Affected   Unknown   Unaffected

Microsoft Corporation

Updated:  June 27, 2008

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

This vulnerability was publicly disclosed by Eduardo Vela.

This document was written by Will Dormann.

Other Information

CVE IDs: None
Severity Metric: 21.87
Date Public: 2008-05-12
Date First Published: 2008-06-27
Date Last Updated: 2008-07-15 17:47 UTC
Document Revision: 4

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.