Corsaire has discovered a vulnerability in multiple vendors' browsers, which can be exploited by malicious people to bypass certain cookie restrictions.

A website can use a path argument for cookies in order to restrict the areas on the website for which a cookie applies and information therefore is exposed to.

However, it is possible to bypass the path restrictions specified by the cookie's originator due to validation errors in multiple browsers, which can be exploited via classic directory traversal character sequences.

This can potentially expose sensitive information stored in cookies associated with certain restricted sections of a site to malicious people, if e.g. a resource on the website outside the restricted area is vulnerable to cross-site scripting attacks.

Example:
http://[host]/restricted_area/%2e%2e/directory/insecure.cgi?xss=<script_code>

Solution
Many of the vendors involved have reportedly patched the issue silently in product releases made after July 2003. Users are therefore advised to update to the latest version of the affected products.
Further details available to Secunia VIM customers

Provided and/or discovered by
Martin O'Neal of Corsaire.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Corsaire:
http://www.corsaire.co.uk/advisories/c030712-001.txt

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers