|
Microsoft Internet Explorer Method Caching Mouse Click Event Hijacking Vulnerability
In BID 8577 and 9009, it was reported that by using a DHTML method an attacker could potentially hijack mouse click events and influence an Internet Explorer user into invoking unintended procedures. This earlier vulnerability was previously addressed by MS03-048. It has been reported that a variation on the previous vulnerability has been discovered that will bypass security measures implemented in MS03-048. By using DHTML method caching functions an attacker may make the moveBy() method of the window object available and so may potentially hijack mouse click events to simulate a drag and drop operation. This attack may also apply to the moveTo(), resizeBy(), and resizeTo() methods of the window object. Like the earlier vulnerability, this could be exploited to place an executable on the victim's system in such a way that it may be run at a later time. This would result in execution of arbitrary code in the context of the victim user. |
|
|
Privacy Statement |
