Microsoft IE Cookie 信息泄露/修改漏洞(MS01-055)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106516 漏洞类型 访问验证错误
发布时间 2001-11-09 更新时间 2005-10-12
CVE编号 CVE-2001-0722 CNNVD-ID CNNVD-200112-041
漏洞平台 Windows CVSS评分 6.4
|漏洞来源
https://www.exploit-db.com/exploits/21144
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200112-041
|漏洞详情
CVE(CAN)ID:CVE-2001-0722CVEID:CAN-2001-0722MicrosoftInternetExplorer存在一个安全漏洞,通过精心构造一个URL请求,可能显示或修改任意站点的Cookie内容。这是由于IE错误处理跨域的Cookie以及"about"协议存在的跨站脚本执行漏洞造成的。
|漏洞EXP
source: http://www.securityfocus.com/bid/3513/info

Internet Explorer contains a vulnerability, which could allow an attacker to construct a URL that would display or modify the cookie information associated with an arbitrary website.

If a URL is composed in the about: protocol referencing a website, Javascript embedded in the URL can access any cookies associated with that website via 'document.cookie'. The Javascript executes because of a cross-site scripting condition in the about: protocol. 

about://www.google.com/<script language=javascript>alert(document.cookie);</script>
|参考资料

来源:BUGTRAQ
名称:20011019MinorIEvulnerability:about:URLs
链接:http://www.securityfocus.com/archive/1/221612
来源:MS
名称:MS01-055
链接:http://www.microsoft.com/technet/security/bulletin/MS01-055.asp
来源:BUGTRAQ
名称:20011108MicrosoftIEcookiesreadableviaabout:URLS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=100527618108521&w=2
来源:XF
名称:ie-about-cookie-information(7486)
链接:http://xforce.iss.net/static/7486.php
来源:BID
名称:3513
链接:http://www.securityfocus.com/bid/3513
来源:OSVDB
名称:1982
链接:http://www.osvdb.org/1982
来源:CIAC
名称:M-016
链接:http://www.ciac.org/ciac/bulletins/m-016.shtml