Microsoft Internet Explorer is prone to an issue that may allow for unauthorized access to local resources. Internet Explorer version 6 SP1 imposed restrictions to limit remote sites from accessing local resources via file:// or res:// URIs (or other variants). It is reported that these restrictions may be bypassed by adding an additional slash when specifying a resource via one of these protocols. This could aid in exploitation of other vulnerabilities, such as issues that permit an attacker to create files on a client system in a predictable location. Such content could then be referenced by an attacker using these protocols. The initial vulnerability report stated that the issue allowed for Zone Restriction Bypass via malformed IFRAMES. Additional technical information has been provided that contradicts the initial analysis. BID 8900 was created to describe the separate issue in Macromedia Flash. Liu Die Yu has released conflicting information that states that this issue occurs...
Microsoft Internet Explorer is prone to an issue that may allow for unauthorized access to local resources. Internet Explorer version 6 SP1 imposed restrictions to limit remote sites from accessing local resources via file:// or res:// URIs (or other variants). It is reported that these restrictions may be bypassed by adding an additional slash when specifying a resource via one of these protocols. This could aid in exploitation of other vulnerabilities, such as issues that permit an attacker to create files on a client system in a predictable location. Such content could then be referenced by an attacker using these protocols. The initial vulnerability report stated that the issue allowed for Zone Restriction Bypass via malformed IFRAMES. Additional technical information has been provided that contradicts the initial analysis. BID 8900 was created to describe the separate issue in Macromedia Flash. Liu Die Yu has released conflicting information that states that this issue occurs because the user is redirected into a local resource and then the local resource is being refreshed. It is reported that other variations such as "file://" or "[DriveLetter]:\[...]" also work with this exploit. This is currently under investigation.
