Internet Explorer Cross Zone Cookiejacking Vulnerability

Publish date: July 21, 2015
  Severity: MEDIUM
  Advisory Date: JUL 21, 2015

  DESCRIPTION

Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1004673
  Trend Micro Deep Security DPI Rule Name: 1004673 - Internet Explorer Cross Zone Cookiejacking Vulnerability

  AFFECTED SOFTWARE AND VERSION

  • Internet Explorer

Featured Stories