Forum Moderators: open
Saw it on the Slashdot. Basicaly when you press the back button in IE, the page you go back to will have the same security zone previledge as the last page you visited. Therefore, a web page that contains malicious Javascript can send the user to a local zone. If the user click on the back button to go back to the previous page, malicious Javascript will gain the local zone previledge. That means, executing local files, reading local files or resources, etc.
Anyone else still using IE here? :(
Two words: 1.Opera 2.Eudora
(I only use Word and PowerPoint because my boss makes me do it.)
A Microsoft spokesman said the Microsoft Security Response Center thoroughly investigated Sandblad's report "and determined that because the proposed exploit scenario is dependent upon specific user interaction as a prerequisite, it does not meet our definition [microsoft.com] of a security vulnerability."
Right. As if clicking the back button was an uncommon user interaction!
Useful comment, later in the article:
Programmer Mikal Zabor also suggested that Windows users, those who "must run Explorer," should consider installing the Windows operating system anywhere but their main (C) drive."Many exploits assume ... you're running Microsoft products, and they assume your system is on the C drive with the default install. If you move the system off the main drive, or set up partitions, you make it harder for malicious hackers."
