Signature Detail
Short Name |
HTTP:STC:IE:CSS-XDOM-DISC |
|---|---|
Severity |
Medium |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Internet Explorer CSS Cross-Domain Information Disclosure |
Release Date |
2006/06/13 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Internet Explorer CSS Cross-Domain Information Disclosure
This signature detects attempts to exploit a known vulnerability against Internet Explorer (IE) 5.0 and 6.0. An information disclosure vulnerability exists in IE because it incorrectly interprets a specially crafted document as a cascading style sheet (CSS). An attacker can exploit this vulnerability by constructing a specially crafted Web page that can potentially lead to information disclosure if a user visits this Web site or clicks a link in a specially crafted e-mail message.
Extended Description
Microsoft Internet Explorer is prone to an issue that allows a violation of the cross-domain security model. The vulnerability arises because Internet Explorer fails to properly parse CSS files and facilitates importing of files that are not valid CSS files. This allows attackers to access HTML and script code from the remote site that was improperly imported as a CSS file. This site may reside in a domain other than the site that exploits the issue. An attacker may exploit this issue to steal sensitive information, which may aid in other attacks.
Affected Products
- Microsoft Internet Explorer 5.0.1
- Microsoft Internet Explorer 5.0.1 For Windows 2000
- Microsoft Internet Explorer 5.0.1 For Windows 95
- Microsoft Internet Explorer 5.0.1 For Windows 98
- Microsoft Internet Explorer 5.0.1 For Windows NT 4.0
- Microsoft Internet Explorer 5.0.1 SP1
- Microsoft Internet Explorer 5.0.1 SP2
- Microsoft Internet Explorer 5.0.1 SP3
- Microsoft Internet Explorer 5.0.1 SP4
- Microsoft Internet Explorer 5.5
- Microsoft Internet Explorer 5.5 Preview
- Microsoft Internet Explorer 5.5 SP1
- Microsoft Internet Explorer 5.5 SP2
- Microsoft Internet Explorer 6.0
- Microsoft Internet Explorer 6.0 SP1
- Microsoft Internet Explorer 7.0 Beta1
- Microsoft Internet Explorer 7.0 Beta2
References