Vulnerability: Microsoft VBScript Same Origin Policy Violation

Microsoft VBScript Same Origin Policy Violation Vulnerability

In modern browsers, script code executing in the context of one website should not be able to access the properties of another. This is a security feature known as the 'same origin policy', and it is put in place to prevent malicious websites from interacting with and possibly stealing sensitive information from others in different windows.


Microsoft Internet Explorer contains a vulnerability related to this protection in its implementation of the VBScript scripting language.

It is possible for malicious VBScript code in one frame to access the properties of another frame in a different domain. The condition is due to a flaw in the calculation of domain boundaries, which attempt to group content from common domains across different frames together.

Exploitation of this vulnerability may result in disclosure of sensitive information from other domains to remote attackers. Attackers may be able to obtain sensitive information from content belonging to other websites (such as usernames, passwords, etc). It is also possible to for attackers to read the contents of files on client systems if the complete path to the file is known.

This is similar to the issue described in the Vulnerability Database record for Bugtraq ID 3721, but due to a separate code flaw.

Remote: Yes

Exploit: There is no exploit code.

Solution: A fix is available at Windows Update (link in the references section of this alert).

Direct download links are available below:





Microsoft Internet Explorer 5.01:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp

Microsoft Internet Explorer 5.0.1SP2:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp

Microsoft Internet Explorer 5.0.1SP1:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp

Microsoft Internet Explorer 5.5SP2:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp

Microsoft Internet Explorer 5.5SP1:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp

Microsoft Internet Explorer 5.5:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp

Microsoft Internet Explorer 6.0:

Microsoft Patch Q318089
http://www.microsoft.com/windows/ie/...89/default.asp