I have tested this bug on Opera 6.06/7.23 at Win2k.SP4/Win98SE Japanese. Opera 7.23 was not effected by this bug but Opera 6.06 had a similar bug. Example: http://www.fake_server.com%C0%80@www.real_server.com/ When Opera 6.06 which "Encoding all addresses with UTF-8" (Opera's network setting) is enabled opens the URL above, "%C0%80" will be converted to "\x0000" (*1) and Opera opens "http://www.real_server.com/"; showing "http://www.fake_server.com"; in the address bar or some JavaScript objects and so forth. And Opera 6.06 shows a URL Warining Dialog before it goes to a URL that contains a username so that a user will see the real server's name in HTTP/HTTPS. But in FTP, it does not shows a URL Warining Dialog so that a user cannot see the real information. Sample Code (for Opera 6) : <a href="http://www.fake_server.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%80@www.opera.com/";> http://www.fake_server.com/fake_path/fake_filename.html </a> <a href="ftp://ftp.opera.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32enen723.exe";> ftp://ftp.opera.com/pub/opera/win/723/en/std/ow32enen723.exe </a> *1 Opera 6 has a "UTF-8 Decode Bug". "\xC0\x80" .. "\xC0\xBF", "\xC1\x80" .. "\xC1\xBF" are mapped to "\x0000" .. "\x003F", "\x0040" .. "\x007F". Due to this bug, Opera 6 has so many troubles. Thanks. nesumin -----Original Message----- From: <bugtraq@zapthedingbat.com> Sent: 9 Dec 2003 14:44:16 -0000 To: bugtraq@securityfocus.com Subject: Internet Explorer URL parsing vulnerability > > > Internet Explorer URL parsing vulnerability > Vendor Notified 09 December, 2003 > > # Vulnerability ########## > There is a flaw in the way that Internet Explorer displays URLs in the address bar. > > By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the current location. > > # Exploit ########## > By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character. > Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. > > # POC ########## > http://www.zapthedingbat.com/security/ex01/vun1.htm > > # Tested ########## > Internet Explorer > Version 6.0.2800.1106C0 > Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145 > > # Credit ########## > Zap The Dingbat > http://www.zapthedingbat.com/
