10983 : Multiple Browser Cross Tab Dialog Box Spoofing
Printer | http://osvdb.org/10983 | Email This | Edit Vulnerability

Views This Week
4

Views All Time
87

Info

Last Modified
7 months ago

Percent Complete
100%

Disclosure
Oct 20, 2004

Discovery
Unknown

Dates

Exploit
Oct 20, 2004

Solution
Unknown

Description

 Multiple web browsers contain a flaw that may lead to an unauthorized information disclosure. The issue is triggered by an attacker creating a specially-crafted web page that would produce an inactive tab or window to launch a dialog box that appears to come from a trusted source, which could disclose sensitive information resulting in a loss of confidentiality.

Classification

 Location: Remote/Network Access Required
Attack Type: Hijacking, Information Disclosure
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Solution

 Upgrades are currently available from these vendors to remediate this vulnerability:

KDE: Upgrade to version 3.3.1

A workaround is available for:

Mozilla
FireFox
Netscape
Opera
Avant Browser
Safari
Maxthon
Internet Explorer for Mac

It is possible to correct the flaw by implementing the following workaround(s):

1. Disable JavaScript
2. Do not visit untrusted and trusted websites at the same time.

Products
Apple Computer, Inc.
Watch-list
Safari
Watch-list
 1.2.3
Avant Force
Watch-list
Avant Browser
Watch-list
 10.0 build 029
9.02 build 101
KDE Project
Watch-list
Konqueror
Watch-list
 3.2.2-6
KDE
Watch-list
 3.0.5
Mozilla Organization
Watch-list
Firefox
Watch-list
 0.10.1
Mozilla
Watch-list
 1.7.3
Camino
Watch-list
 0.8
Mysoft Technology
Watch-list
Maxthon
Watch-list
 1.1.039
Netscape Communications Corporation
Watch-list
Netscape
Watch-list
 7.2
Opera Software
Watch-list
Opera
Watch-list
 7.54
Microsoft Corporation
Watch-list
Internet Explorer for Mac
Watch-list
 5.2
Stilesoft Inc.
Watch-list
NetCaptor
Watch-list
 7.5.2
iCab
Watch-list
iCab
Watch-list
 2.9.8
FlashPeak
Watch-list
Slim Browser
Watch-list
 4.01.003
The Omni Group
Watch-list
OmniWeb
Watch-list
 5.0.1
Epiphany
Watch-list
Epiphany
Watch-list
 1.4.4
Galeon
Watch-list
Galeon
Watch-list
 1.3.18

References

Tools & Filters

Nessus

 17624 17626 18320 20546

Credit
  • Jakob Balle - jbBrand New Doo Doosecunia.com - Secunia Research

Blogs

Provided by Technorati

 None found at this time

Comments

Add Comment

No Comments.

DONATE NOW!

User Status

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use