From the "Security Wire Digest"

*IE "BACK BUTTON" POSES RISK
By Shawna McAlearney
"Using the back button in IE (Internet Explorer) is dangerous" because it could allow an attacker to execute code and read local files, wrote a security researcher in an advisory released to Bugtraq this week.

Testing IE 6.0 running on Windows 2000 and XP, Andreas Sandblad determined that IE places URLs containing the Java Script protocol in the history list, allowing code injected in the URL to operate in the same zone/domain as the last URL visited.

"The normal behavior when a page fails to load is to press the back button," says Sandblad. "The error page shown by IE is operating in the local computer zone. Thus, we can execute code and read local files."

Though only ranked as a moderate threat because it requires user interaction, the problem poses several security and privacy risks.

"This security issue is a major threat on privacy for anyone using Internet Explorer," says Sandblad, a student in engineering physics at the University of Umea in Sweden. "Basically, it allows Webmasters to retrieve a lot of sensitive information like cookies and local files from visitors and also enables programs to execute. Without your knowledge, you could end up sending away passwords to your Internet bank account or your secret love letter."

Sandblad says he notified Microsoft of the problem last November, but a patch hasn't been released.

"We...determined that because the proposed exploit scenario is dependent upon specific user interaction as a prerequisite, it does not meet our definition of a security vulnerability," says a Microsoft spokesperson. "This scenario does not constitute a viable threat to users following standard best practices. That said, we remain vigilant in our commitment to keeping users' information safe and will be addressing this issue in an upcoming release."

The recommended workaround is to disable active scripting or not using the back button.

(Emphasis added is mine. Too bad we can't add the sws flag!)

[link|http://online.securityfocus.com/archive/1/267561|BugTraq Link]