When Norton Internet Security 2003 blocks a web site, it returns a web page to the browser stating that the site has been blocked. This error message contains the URL which was requested. Norton Internet Security 2003 appears to do no validation or encoding of the URL before returning it in the error message. This allows an attacker to supply a URL that contains script. This script will run in the context of the blocked site.
We have marked this as a low risk because we believe in most situations, there will be little information of interest since the site is normally blocked (browser cookies from the blocked site probably do not exist, etc). However this does allow sites that are blocked to run script on the victim's machine when it shouldn't be allowed.
source:
digital pranksters
