[NEWS] Internet Explorer and Opera JavaScript Ghost Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Internet Explorer and Opera JavaScript Ghost Vulnerability
------------------------------------------------------------------------


SUMMARY

A bug in Internet Explorer and Opera's processing of JavaScript allows 
attackers to run a JavaScript on the computer of the surfer, while the 
making its source code inaccessible to the user.

DETAILS

Vulnerable Systems:
 * Internet Explorer 6 SP2
 * Opera version 7.54
 * Opera version 8

Normally the code of an HTML page and all of it's JavaScript code is 
visible to the user if the user asks for the source code of the HTML page.

Exploit:
< h1>Something < i>before</i></h1>
< br> the < b>JavaScript</b>... Blablalbla
< script type="text/jscript">
function init() {
document.write("The time is now: " + Date() );
}
window.onload = init;
</script>
And < u>something</u> after the < b>JavaScript</b>... Blablablablabla

If the user browser is vulnerable for this vulnerability, the result will 
be  "The time is now xxx" , where xxx is the date and time. While the user 
will not see the "Something before the JavaScript" and also not the "and 
something after the JavaScript".

Disclosure Timeline:
07-06-2005 - The bug was reported to the vendor
08-06-2005 - The bug was reported to the vendor


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Pascal Vyncke.
The original article can be found at:  
<http://research.seniorennet.be/Techresearch/Javascript_security_flaw_bug_ie_6/security_flaw_bug_javascript_ie_6_internet_explorer.php> Security flaw bug javascript ie 6 internet explorer



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.