June 2006

ID: 00448
Ref: 435/2006
Date: 29 June 2006:14:26:07
Version: 1

---

Title: US-CERT Vulnerability Note VU#883108 Microsoft Internet Explorer HTML Document object cross-domain vulnerability
Abstract: Microsoft Internet Explorer contains a cross-domain vulnerability in how it handles redirected object data. This could allow an attacker to access the content of a web page in a different domain.
Vendors affected: US CERT
Operating systems affected: US CERT
Applications affected: US CERT

---

Title
=====

US-CERT Vulnerability Note VU#883108
Microsoft Internet Explorer HTML Document object cross-domain vulnerability

Detail
======

Overview

Microsoft Internet Explorer contains a cross-domain vulnerability in
how it handles redirected object data. This could allow an attacker
to access the content of a web page in a different domain.

I. Description

The Cross-Domain Security Model

IE uses a cross-domain security model to maintain separation between
browser frames from different sources. This model is designed to
prevent code in one domain from accessing data in a different domain.
The Internet Security Manager Object determines which zone or domain
a URL exists in and what actions can be performed. From Microsoft
Security Bulletin MS03-048:

One of the principal security functions of a browser is to ensure
that browser windows that are under the control of different Web sites
cannot interfere with each other or access each other's data, while
allowing windows from the same site to interact with each other. To
differentiate between cooperative and uncooperative browser windows,
the concept of a "domain" has been created. A domain is a security
boundary - any open windows within the same domain can interact with
each other, but windows from different domains cannot. The cross-domain
security model is the part of the security architecture that keeps
windows from different domains from interfering with each other.

The HTML Document object

The HTML Document object provides the core HTML rendering functionality
of the Internet Explorer web browser. This object is provided by the
file mshtml.dll. A web page can make use of the HTML Document object
as an ActiveX control by using the