Internet Explorer Global Variables Local File Dete

[Mobo]

Internet Explorer Global Variables Local File Detection Weakness
The problem is that sites from the "Internet" zone can include scripts from local resources. This can be exploited to determine the presence of local scripts by checking the existence of global variables introduced in the included script.

NOTE: This is similar to an old issue, which used the window.onerror event to catch errors in the loading of local scripts.

The weakness has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2.

Solution:
Disable Active Scripting support for all but trusted sites.