Internet Explorer权限许可和访问控制漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105597 漏洞类型 后置链接
发布时间 1999-11-04 更新时间 2005-10-12
CVE编号 CVE-1999-0981 CNNVD-ID CNNVD-199912-037
漏洞平台 Windows CVSS评分 5.1
|漏洞来源
https://www.exploit-db.com/exploits/19591
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-037
|漏洞详情
InternetExplorer5.01以及更早的版本存在漏洞。远程攻击者借助创建客户端窗口的一个引用,并使用服务器端重定向方法通过的方法,即可访问本地文件,也称为“服务器端页引用重定向”。
|漏洞EXP
Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4,Outlook 98 0 window.open Redirect Vulnerability

source: http://www.securityfocus.com/bid/766/info

If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage.

The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser. 

The exploit code is:
a=window.open(some URL that redirects to the local file);
b=a.document;
|参考资料

来源:MS
名称:MS99-050
链接:http://www.microsoft.com/technet/security/bulletin/ms99-050.mspx
来源:MSKB
名称:Q246094
链接:http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q246094