Bugtraq mailing list archives

Re: Pine 4.33 (at least) URL handler allows embedded commands.

From: Michal Zalewski <lcamtuf () coredump cx>
Date: Sun, 6 Jan 2002 17:37:43 -0500 (EST)

On Sat, 5 Jan 2002, zen-parse wrote:

Problem:              URL handler allows embedded commands.
                      May allow email viruses of the Outlook kind.

  http://address/'&/some/program${IFS}with${IFS}arguments&&apos;


Isn't that old news? http://www.securityfocus.com/bid/810

I *can* be wrong, but it looks like it is the same problem...

-- 
_____________________________________________________
Michal Zalewski [lcamtuf () bos bindview com] [security]
[http://lcamtuf.coredump.cx] <=-=> bash$ :(){ :|:&};:
=-=> Did you know that clones never use mirrors? <=-=
          http://lcamtuf.coredump.cx/photo/

Current thread:

Pine 4.33 (at least) URL handler allows embedded commands. zen-parse (Jan 05)
- Re: Pine 4.33 (at least) URL handler allows embedded commands. Michal Zalewski (Jan 07)
  - Re: Pine 4.33 (at least) URL handler allows embedded commands. zen-parse (Jan 08)
  - Re: Pine 4.33 (at least) URL handler allows embedded commands. Roman Drahtmueller (Jan 08)