Re: XSS in Internet Explorer 6 and 7

[Thierry Zoller <Thierry () Zoller lu>]

Dear MustLivee,
M> Which is also
M> available on English (http://securityvulns.ru/Udocument911.html).

Refering to the above, could you briefly explain :

==============
This attack works in Internet Explorer when option “Initialize and
script ActiveX control not marked as safe” (for Local intranet) is turned
on (Enabled or Prompt). It's such bug in hole of Microsoft :-) and it's
method of bypassing of the bug. This setting is needed only during attack
via this XSS, when JS code placed on the same line, where there is a
comment. Because if it's on other line (i.e. without preceding comment),
then code will work and without this setting (Disable). That can be
achieved in case, when attack made not via XSS, but the attack code is
placed (in appropriate way) directly in body of page.
==============

Your saying above that this attack works if "Initialise and script
ActiveX control not marked as safe" is ENABLED.

Then you say that:
"if it's on other line (i.e. without preceding comment),
then code will work and without this setting (Disable)"

My question is, if this attack works with disabling access to unsafe
controls without "preceding comment", why use the preceding comment
at all ?

If I understood you correctly this only works if the page is saved to
the harddisk and then run?.







-- 
http://secdev.zoller.lu
Thierry Zoller