Security Intelligence Operations

Microsoft Internet Explorer contains a vulnerability that could allow an attacker to bypass cross-domain security restrictions..

This vulnerability exists due to insufficient cross-domain security restrictions on document windows.  An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to visit a malicious site.  If successful, the attacker could access sensitive browser-based information from a third-party site.  On Windows 2000 systems, an attacker may also be able to leverage this vulnerability to execute arbitrary code with the privileges of the user.

Proof of Concept code is publicly available.

Microsoft has confirmed this vulnerability and released updated software.

Microsoft Internet Explorer versions 5.01 SP4 and prior, 6.0 SP1 and prior and Internet Explorer 7.0 are vulnerable on the following operating systems:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 for Itanium-based Systems SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Vista SP1 and prior
• Windows Vista x64 Edition SP1 and prior
• Windows Server 2008 for 32-bit Systems
• Windows Server 2008 for x64-based Systems
• Windows Server 2008 for Itanium-based Systems

To exploit the vulnerability, an attacker must convince a user to visit a malicious website.  The attacker may provide URLs to the website in e-mail messages.  From the malicious site, the attacker could open a new window to a trusted, third-party site that an attacker could monitor from the malicious site.  The attacker could access information contained within that third-party website or monitor user-supplied input. 

An attacker could leverage this vulnerability to conduct phishing attacks by targeting financial websites or other trusted sites and stealing input account information or cookie-based authentication credentials.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for October 2008 

Microsoft has released a security bulletin at the following link: MS08-058

US-CERT has released a vulnerability note available at the following link: VU#923508