Security

>   1) Attacker controls DNS zone *.baz.com, configuring it as follows:
> 
>       a) foo.bar.baz.com -> some web server operated by the attacker
>       b)     bar.baz.com -> 10.0.0.9 (some address behind BigCo's firewall)
> 
>   2) The attacker induces unsuspecting user at BigCo to visit
>      http://foo.bar.baz.com/.
> 
>   3) A JavaScript on said page sets document.domain to "bar.baz.com"
>      (this is valid since bar.baz.com is a parent domain of
>      foo.bar.baz.com). See [1]. Also note that this step is not
>      strictly necessary, but substantially improves the performance of
>      the exploit and the ease of implementation.
> 
>   4) JavaScript on the page then loads a page from
>      http://bar.baz.com/somePrivatePage.html into a hidden frame. This
>      page will be retrieved from 10.0.0.9, a machine behind the
>      firewall.

Just thinking, this would only work if the intranet proxy would also 
serve internal webservers. Right? Wrong? I see no reason why an proxy 
would serve documents for the intranet. I know ours doesn't. If your 
request intranet pages from the DMZ proxy you get a boilerplate page 
explaining you how to exclude intranet pages from your proxy setup for 
various browsers.

Emile


_______________________________________________
http://lists.xwt.org/listinfo/dev