RE: Re: Internet Explorer URL parsing vulnerabi lity

[Frank Knobbe <frank () knobbe us>]

On Thu, 2003-12-11 at 11:22, David Vincent wrote:
> > Try this one:
> > http://petard.freeshell.org/ms-announce.html
>
> displayed as "http://www.microsoft.com%01 () slashdot org/" in the latest
> Firebird 0.7+ nightly.

In addition, Galeon and Ephinany display it like that. No user account
warning as with Opera though.

> displayed as "http://www.microsoft.com
@slashdot.org/" in Opera 7.23 AFTER
> getting a warning about going to an URL which includes a username.
>
> displayed as "http://www.microsoft.com
@slashdot.org/" in Avant Browser 8.02
> Build 207
>
> displayed as "http://www.microsoft.com"; in IE 6.0.2800.1106
>
> all are on W2k Pro SP4 et al.

Attachment: signature.asc
Description: This is a digitally signed message part