Home page logo

bugtraq logo Bugtraq mailing list archives

Internet Explorer Code Execution Bypass Vulnerability
From: aikon none <aikon.bcn () gmail com>
Date: 17 Dec 2004 17:03:37 -0000

Last week I discovered a vulnerability to avoid/overrun/bypass the new protection for Local JS Execution on IE (winxp 

--cut here--

window.alert("Example Exploit");

--cut here--

(Copy and paste into your Notepad and save it as EXAMPLE.HTM)

If you open EXAMPLE.HTM, your IE blocks this code and shows a yellow bar over the webpag.

But I discovered a vulnerability to allow Local JS Code to execute on IE, the exploit is:

"Go to Control Panel / Display Config and set as the desktop background the example webpage (EXAMPLE.HTM), once this is 
done, the code will be executed without showing any warning in IE"


My Webpag:  www.madantrax.cjb.net
My ClanWeb: www.darknessteam.com
ForumClan:  foro.darknessteam.com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]