| Huge security holes found in IE, Firefox |
Jun. 05, 2007
A researcher, Michal Zalewski, on June 4 reported a JavaScript flaw in fully patched IE 6 and 7 that can allow an attacker to fiddle with a document's Document Object Model -- a model for representing HTML or XML and related formats.
The result can be cookie stealing or cookie resetting, browser crash, page hijacking, code injection or memory corruption.
The vulnerability occurs when JavaScript code instructs the IE application to navigate away from a page that meets same-domain origin policy, Zalewski said.
This makes it possible for an attacker to access and modify the command, directing the browser to an unrelated third-party site. During the redirect, the attacker has a window of time in which to execute JavaScript that has permissions pertaining to the first page visited, not the third-party page to which the browser has been redirected.
To read the rest of Lisa Vaas' eWEEK.com article, go here.
Related Stories:
(Click here for further information)
|
|
|
|
|
|
|
|
