ID

VAR-200407-0006

CVE

CVE-2004-0720

TITLE

Microsoft Internet Explorer fails to properly restrict access to frames

DESCRIPTION

Safari 1.2.2 does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. Microsoft Internet Explorer fails to properly restrict access to a document's frames, which may allow an attacker to modify the contents of frames in a different domain. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ Microsoft Internet Explorer 6.0 SP1 Previously, there was a flaw in the cross-domain security check function for the content in the frame, so it opened in a new window Web There is a problem that allows the display of content from different domains within the frame of the page. (CAN-2004-0719) Remote attackers who exploit this issue are trusted Web Disguised to display content in the frame that uses the site's frame to instruct user account and card information input Web By navigating to the site, you may eventually be able to capture important information about the target user. still, Microsoft Windows Server 2003 The default setting for Internet Explorer Enhanced security configuration (Enhanced Security Configuration) Is valid and is not affected by this issue. Also this problem IE 3.x/4.x Previous issues with patches released for (MS98-020) It is reported by the discoverer that it is the same thing. In addition, the problem is Web It also exists in the browser. ・ Opera 7.51 Before (CAN-2004-0717) ・ Microsoft Internet Explorer for Mac 5.2.3 (CAN-2004-0719) ・ Mozilla 1.6 Before (CAN-2004-0718) ・ Mozilla Firebird 0.7 for Linux (CAN-2004-0718) ・ Mozilla Firefox 0.x (CAN-2004-0718) ・ Netscape 7.x (CAN-2004-0718) ・ Safari 1.x (CAN-2004-0720) ・ KDE Konqueror 3.2.3 Before (CAN-2004-0721) The above Web It has been suggested that this problem exists in addition to browser versions.Please refer to the “Overview” for the impact of this vulnerability. An attacker can exploit this issue to change the location of a frame from a different domain. Successful exploits will allow the attacker to access information from the parent document via DOM components that are not domain-reliant (such as the 'onmousedown' event). Internet Explorer 6, 7, and 8 Beta 1 are vulnerable; other versions may also be affected. Apple Safari is reported prone to a cross-domain frame loading vulnerability. It is reported that if the name of a frame rendered in a target site is known, then an attacker may potentially render arbitrary HTML in the frame of the target site. An attacker may exploit this vulnerability to spoof an interface of a trusted web site. To exploit this vulnerability a victim will need to visit a website hosted by an attacker. The attackers site will then spawn a trusted site in a window, if exploited successfully; the attackers site will place data into the IFRAME of the trusted site. This vulnerability may aid in Phishing style attacks. The version of Safari included in Apple Mac OS X versions 1.2.8, 10.3.4, and 10.3.5 is reported vulnerable to this issue. Mac OS X is an operating system used on Mac machines, based on the BSD system. Apple reports that malicious users using malicious WEB sites can inject HTML content into frames used by other domains. As a result, remote users can modify the content of some frames on legitimate web sites that use multiple frames. Cause to deceive target users and obtain other information. For more information: SA11978 Secunia has constructed a test, which can be used to check if your browser is affected: http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/ The vulnerability has been confirmed in Camino 0.8.4, but does not affect version 0.8.3. This may be a variant of: SA11966 The vulnerability is confirmed in IE7. SOLUTION: Do not visit or follow links from untrusted websites. The vulnerability also affects Internet Explorer: SA11966 SOLUTION: Do not browse untrusted sites while browsing trusted sites. The following browsers are not affected: * Mozilla Firefox 0.9 for Windows * Mozilla Firefox 0.9.1 for Windows * Mozilla 1.7 for Windows * Mozilla 1.7 for Linux PROVIDED AND/OR DISCOVERED BY: Reported in Mozilla browser by: Gary McKay OTHER REFERENCES: SA11966: http://secunia.com/advisories/11966/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet@packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

Failure to Handle Exceptional Conditions

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Apple

SOURCES

LAST UPDATE DATE

2024-08-14T12:44:46.555000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE