HTTP: Internet Explorer 8 toStaticHTML

This signature detects attempts to exploit a known vulnerability in Microsoft Internet Explorer 8. An attacker can create a malicious Web site that contains Web pages with script calls to toStaticHTML, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Internet Explorer 8 is prone to a security-bypass weakness. Internet Explorer 8 includes a method designed to sanitize executable script constructs from HTML. Attackers can bypass this protection, allowing script code to execute on the client, for example in a 'postMessage' call. Attackers can leverage this issue to obtain sensitive information or potentially launch cross-site scripting attacks on unsuspecting users of targeted sites. Other attacks may also be possible.

Affected Products

Avaya messaging_application_server,Avaya aura_conferencing

References

BugTraq: 42467

URL: http://seclists.org/fulldisclosure/2010/Aug/178 http://www.microsoft.com/windows/ie/ http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx

Short Name

HTTP:STC:IE:TOSTATICHTML

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: Internet Explorer 8 toStaticHTML

Extended Description

Affected Products

References

Found a potential security threat?