Signature Detail

HTTP: Microsoft Internet Explorer Copy And Paste Information Disclosure

This signature detects attempts to exploit a known vulnerability against Microsoft Internet Explorer. It is due to insufficient validation of data during copy and paste operations between iframe elements. A remote attacker could exploit this vulnerability by enticing a target user to visit a malicious website, copy some content and paste it on the target. Successful exploitation would allow the attacker to access content from another domain or a different Internet Explorer zone.

Extended Description

Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because it fails to adequately validate user-supplied data during copy and paste operations. An attacker can exploit this issue to view content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or aid in further attacks.

Affected Products

• Avaya Aura Conferencing 6.0 Standard
• Avaya CallPilot 4.0
• Avaya CallPilot 5.0
• Avaya Communication Server 1000 Telephony Manager 3.0
• Avaya Communication Server 1000 Telephony Manager 4.0
• Avaya Meeting Exchange 5.0
• Avaya Meeting Exchange 5.0.0.0.52
• Avaya Meeting Exchange 5.0 SP1
• Avaya Meeting Exchange 5.0 SP2
• Avaya Meeting Exchange 5.1
• Avaya Meeting Exchange 5.1 SP1
• Avaya Meeting Exchange 5.2
• Avaya Meeting Exchange 5.2 SP1
• Avaya Meeting Exchange 5.2 SP2
• Avaya Meeting Exchange - Client Registration Server
• Avaya Meeting Exchange - Recording Server
• Avaya Meeting Exchange - Streaming Server
• Avaya Meeting Exchange - Web Conferencing Server
• Avaya Meeting Exchange - Webportal
• Avaya Messaging Application Server 4
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server 5.2
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 7.0
• Microsoft Internet Explorer 8
• Microsoft Internet Explorer 9

References

• BugTraq: 51931
• CVE: CVE-2012-0010