Slashdot Mirror
IE Flaw Exposes Users To Spoof-Based Attacks
Sotos wrote to mention a C|Net article discussing a new spoof-based attack on Internet Explorer. From the article: " The problem lies in the way Microsoft has implemented a JavaScript component in its Web browser, security researcher Amit Klein wrote in a research document. Internet Explorer does not validate some data fields provided by a PC when the component, called XmlHttpRequest, is used, he wrote. The vulnerability could be exploited with specially crafted code. An attacker could spoof a legitimate Web site, access data from the Web browser's cache or stage a so-called man-in-the-middle attack, which taps into traffic between a user and another Web site, according to Klein's write-up. " Secunia has an alert up on the spoof.
It is the thingy that powers AJAX
I was being just a tad sarcastic.
XmlHttpRequest is the javascript object that allows for asynchronous communication between your web browser and a server located elsewhere on the internet, i.e. the first A in AJAX.
I'll start with the securia site.
Internet Explorer: Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical...Currently, 20 out of 86 Secunia advisories, is marked as "Unpatched" in the Secunia database.
FireFox: Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical...Currently, 3 out of 24 Secunia advisories, is marked as "Unpatched" in the Secunia database.
"In the game of life, someone always has to lose. To me, if life were fair, that someone would always be Oklahoma." -DKR
You only have to write Javascript to use it, but that doesn't change the fact that the XMLHttpRequest object is provided by ActiveX, and if you switch off ActiveX, XMLHttpRequest stops working.
This will change in Internet Explorer 7, which implements XMLHttpRequest as a native host object in the same way as other browsers. There's some discussion of this on the IE Blog.
Bogtha Bogtha Bogtha
The problem is with the proxy servers, not IE.
Read the paper
Yawn...
Try the IE View Plugin Here: http://ieview.mozdev.org/
I guess you never read the story on ZDnet about a month ago, and MS was "looking into it". Apparently this does work and yet MS dropped the ball again, nothing knew, just expected sooner.
XmlHttpRequest is a for client-side script to submit an http request and receive the results as XML or text. It's pretty cool because you can make a web page behave like a little client-server app, eliminating the need for page refreshes and session state maintenance. The name AJAX was made up recently, but the technique has been around for years, ever since IE4. Microsoft implemented it as an ActiveX object, but Mozilla now supports it natively.
Um, there is. Look for a View in Internet Explorer extension for FF. They did actually release a View in Firefox extension for IE, too, but I don't know if that still exists.
That is one of the best comments about what the problem actually is that I have ever read.
I would say that the ActiveX and CSS are my two main headaches with IE. The other would be the lack of tabbed browsing but I don't use IE.
if you steal from one source, that is plagiarism, if you steal from many, well, that's just research.
The Firefox vulnerabilities described in that Secunia page you link to were fixed in version 1.07, which was released two days before the page you link to was written.
Where is Microsoft's patch for this IE vulnerability?
I'm sorry, but all you have managed to do is prove, once again, that while open source software certainly does not prevent bugs and security holes, it does do a whole damn lot better than Microsoft at fixing them when they appear.
I think the stuff initiated via COM via ActiveX, even though the programmer is only using JS.
I fail to see why this is even considered an issue. You can EASILY spoof any website with server-side code and the "attack" is cross-browser.
e w ActiveXObject('Microsoft.XMLHTTP');}catch(oc){A=nu ll;}}if (!A && typeof XMLHttpRequest!='undefined'){A=new XMLHttpRequest();}/ /www.google.com', false);
The security bulletin talks about how using a specifically formed URL, you can download content from a remote site. I do the same thing all the time with a simple bridge in php:
httpbridge.php:
---------------
so if you want to get content from google in javascript:
var A=null;try{A=new ActiveXObject('Msxml2.XMLHTTP');}catch(e){try{A=n
A.open('GET', 'http://www.yoursite.com/httpbridge.php?url=http:
A.send()
document.write(A.responseText);
And now you can do any of the listed attacks in any browser. This is nothing new, lots of people already do it for useful reasons. The most recent use I've found is to pull geocodes.