TITLE:
Microsoft Internet Explorer CSS Import Disclosure of Sensitive
Information

SECUNIA ADVISORY ID:
SA17564

VERIFY ADVISORY:
http://secunia.com/advisories/17564/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Microsoft Internet Explorer 6.x
http://secunia.com/product/11/

DESCRIPTION:
Matan Gillon has discovered a vulnerability in Microsoft Internet
Explorer, which can be exploited by malicious people to disclose
potentially sensitive information.

The vulnerability is caused due to an error where the content of
imported CSS (Cascading Style Sheets) from other domains is not
properly protected from being read via the "cssText" DHTML property.

This can be exploited by a malicious web site to disclose parts of
the content of certain documents served from another web site (e.g.
HTML documents with a certain structure which can be parsed by the
internal CSS parser), by loading the document via the "@import"
directive and accessing the content of it via JavaScript.

The vulnerability has been confirmed on a fully patched system with
Internet Explorer 6.0 and Microsoft Windows XP SP2.

SOLUTION:
Disable Active Scripting except for trusted sites.

PROVIDED AND/OR DISCOVERED BY:
Matan Gillon

ORIGINAL ADVISORY:
http://www.hacker.co.il/security/ie/css_import.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------