Description
Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
References
- 17564 third-party-advisory
- oval:org.mitre.oval:def:1977 vdb-entry signature
- oval:org.mitre.oval:def:1800 vdb-entry signature
- oval:org.mitre.oval:def:1838 vdb-entry signature
- ADV-2006-2319 vdb-entry
- 1016291 vdb-entry
- oval:org.mitre.oval:def:1985 vdb-entry signature
- http://www.hacker.co.il/security/ie/css_import.html
- oval:org.mitre.oval:def:1556 vdb-entry signature
- oval:org.mitre.oval:def:1914 vdb-entry signature
- 15660 vdb-entry
- ADV-2005-2804 vdb-entry
- MS06-021 vendor-advisory