HTTP: Microsoft Internet Explorer Javascript Page Update Race Condition

This signature detects attempts to exploit a known vulnerability against Microsoft Internet Explorer. A successful attack may results in sensitive information being disclosed to the attacker.

Extended Description

The browser is prone to a cross-domain information-disclosure vulnerability because scripts may persist across navigations. This vulnerability may let a malicious site interact with a site in an arbitrary external domain. Attackers could exploit this to gain access to sensitive information that is associated with the external domain. Other attacks may be possible, such as executing script code in other browser security zones. UPDATE: Reports indicate that Safari browser may also be vulnerable, but this has not been confirmed. UPDATE (June 6, 2007): The WebKit framework used by Safari is reported vulnerable. Builds 522 and later, which are associated with the nightly WebKit build, are vulnerable; other versions may also be affected.

Affected Products

Avaya messaging_application_server,Microsoft internet_explorer

References

BugTraq: 24283

CVE: CVE-2007-3091

Short Name

HTTP:STC:IE:PAGE-UPDATE-RACE

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Internet Explorer Javascript Page Update Race Condition

Extended Description

Affected Products

References

Found a potential security threat?