This is a multi-part message in MIME format.
------=_NextPart_000_01CC_01C53143.E93FF5A0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Maxthon browser search bar information disclosure advisory
URL: http://www.raffon.net/advisories/maxthon/searchbarid.html
Date: March 25, 2005
Author: Aviv Raff
Introduction
"Maxthon Internet Browser software is a powerful tabbed browser with a
highly customizable interface. It is based on the Internet Explorer browser
engine..." (from Maxthon website ).
Maxthon installs by default a search utility bar, which contains an
information disclosure vulnerability.
Technical Details
Maxthon's API includes a property named "m2_search_text", which allows
plug-ins to interact with the search bar.
Any website the user visits can easily fetch the search bar's data using
this property, the same way plug-ins do.
Tested version: 1.2.0
Older versions might be affected too.
Proof Of Concept
http://www.raffon.net/advisories/maxthon/searchbarpoc.html
Timetable
02-Mar-2005: Vendor informed.
03-Mar-2005: Vendor confirmed vulnerability.
24-Mar-2005: Vendor published a fixed version.
25-Mar-2005: Public disclosure.
Solution
Upgrade to version 1.2.1.
Disclaimer: The information in this advisory and any of its demonstrations
is provided "as is" without warranty of any kind.
-- Copyright C 2005 Aviv Raff. --
------=_NextPart_000_01CC_01C53143.E93FF5A0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Maxthon browser search bar information disclosure advisory
URL: http:/=
/www.raffon.net/advisories/maxthon/searchbarid.html
Date:=20
March 25, 2005
Author: Aviv Raff
Introduction
"Maxthon Internet Browser software is a =
powerful=20
tabbed browser with a highly customizable interface. It is based on the =
Internet=20
Explorer browser engine..." (from Maxthon website).
Maxthon installs by =
default a=20
search utility bar, which contains an information disclosure =
vulnerability.
Technical Details
Maxthon's API includes a =
property named "m2_search_text", which allows =
plug-ins to=20
interact with the search bar.
Any website the user visits can easily =
fetch=20
the search bar's data using this property, the same way plug-ins=20
do.
Tested version: 1.2.0
Older versions might be affected =
too.=20
Proof Of Concept
http:=
//www.raffon.net/advisories/maxthon/searchbarpoc.html
Timetable
02-Mar-2005: Vendor informed.
03-Mar-2005: =
Vendor=20
confirmed vulnerability.
24-Mar-2005: Vendor published a fixed=20
version.
25-Mar-2005: Public disclosure.
Solution
Upgrade to version 1.2.1.
Disclaimer: The information in this advisory and any of its =
demonstrations=20
is provided "as is" without warranty of any kind.
-- Copyright =
© 2005 Aviv=20
Raff. --
------=_NextPart_000_01CC_01C53143.E93FF5A0--