Members
  • Total Members: 14176
  • Latest: toxxxa
Stats
  • Total Posts: 42869
  • Total Topics: 16078
  • Online Today: 3435
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)









Author Topic: IE 8 XSS Vulnerability To Get Fixed in June (MS10-002, MS10-018)  (Read 2177 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


Microsoft is preparing a security update in June for the IE XSS filter in Internet Explorer 8: http://blogs.msdn.com/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx

The update will address a flaw in IE 8 that could enable cross-site scripting (XSS) attacks by hackers. Security Response Center spokesman David Ross said last week in this blog post that the change will address the "script tag attack scenario" that was described at a Blackhat Europe presentation earlier this month: http://blogs.technet.com/msrc/archive/2010/04/19/guidance-on-internet-explorer-xss-filter.aspx

At that conference, security researchers David Lindsay and Eduardo Vela Nava presented their findings on how the IE 8 XSS filter could be abused, resulting in universal cross-site scripting (UXSS) attacks.

Security experts and Microsoft's Ross explained that unlike traditional XSS attacks that require the vulnerability to exist on a specific infected Web site, UXSS attacks target vulnerabilities in client applications, such as browsers, browser plugins, and PDF readers.

"This issue manifests when malicious script can "break out" from within a construct that is already within an existing script block," wrote Ross. He added that while the issue was preliminarily identified and addressed in a January patch of the browser (MS10-002: http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx ), the new real-world example of UXSS is prompting Microsoft to prep a new patch for June.

Chenxi Wang, security and risk management analyst at Forrester Research, said this vulnerability is brought on when the XSS filter incorrectly disables certain Hypertext Mark-up Language (HTML) attributes. Consequently, it becomes possible for a specially crafted Web page to be loaded, allowing an attacker to execute scripts in a user's browser.

"This mistake made by the cross-site scripting filter in IE actually caused a cross-site scripting error to occur," she said. "This is interesting, because the mission of the XSS filter is to prevent this type of error to happen, but in effect it actually caused an additional XSS attack."

Joshua Talbot, security intelligence manager at Symantec Security Response, added that such an attack requires a multifaceted and sophisticated method of incursion.

"First, they would have to find a suitable target Web site that allows users to publish content, such as a social networking site," he said. "Second, they would have to lure the victim to this page by clicking a specially crafted link. Finally, they would have to have the victim follow the link with a vulnerable Web browser."

Talbot added that with the increasing reliance on browsers and Web sites for banking and communication, UXSS vulnerabilities will become increasingly useful and valuable to attackers.

The researchers who found this security hole worked directly with Microsoft, according to both Wang and Talbot. Microsoft subsequently released its initial update in January and again in March (MS10-018: http://www.microsoft.com/technet/security/bulletin/ms10-018.mspx ).

Security experts applauded the prospect of a more substantive fix release in the early summer. Microsoft's David Ross said that the company looks "forward to continuing to improve the Internet Explorer XSS Filter going forward to address new attack scenarios and the evolving threat landscape."

"Like many security issues--take malware as an example--attack vectors are always a moving target," Ross wrote. "The role of the browser maker is to do everything we can to keep people safe without them having to do a lot of extra work": http://blogs.msdn.com/ie/archive/2010/03/05/ie8-smartscreen-filter-protecting-users-at-internet-scale.aspx

(Journal)

Samker's Computer Forum - SCforum.info


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising