RE: visa XSS?

["Knarr, Joshua" <joshua.knarr () sap com>]

I think this is also the first sighting of the @ vulnerability in the wild.  Or am I mistaken?  It seems the tool 
available from Xforce does nothing to stop this.  (http://xforce.iss.net/xforce/alerts/id/159).

Thanks
Joshua Knarr

> -----Original Message-----
> From: full-disclosure-admin () lists netsys com 
> [mailto:full-disclosure-admin () lists netsys com] On Behalf Of 
> Mauro Flores
> Sent: Tuesday, December 23, 2003 6:45 AM
> To: full-disclosure () lists netsys com
> Subject: [Full-disclosure] visa XSS?
>
> I receive this mail today, the funny stuff is that when you 
> click on the
> link, you execute:
> http://www.visa.com:UserSession=2f6q9uuu88312264trzzz55884495&u
seroption=SecurityUpdate&StateLevel=GetFrom@64.21.80.2/~gotier/verified_by_visa.htm
> I don't have a Visa card and I don't like that 64.21.80.2 
> which is not a
> Visa IP, AFAIK.
> Anyone else receive it??
>
> regards, Mauro Flores
>
> On Tue, 2003-12-23 at 08:29, Mauro Flores wrote:
> > -----Forwarded Message-----
> > From: Visa International Service <security () visa-security com>
> > Subject: Visa Security Update
> > Date: 23 Dec 2003 05:24:34 -0600
> >
> >                                                 [image]
> >                                     
> >                              Dear Customer,
> >                                     
> > Our latest security system will help you to avoid possible 
> fraud actions
> >                                   and
> >                     keep your investments in safety.
> >                                     
> >   Due to technical security update you have to reactivate 
> your account
> >                                     
> >      Click on the link below to login to your updated Visa account.
> >                                     
> >       To log into your account, please visit the Visa Website at 
> >                                     
> >                           http://www.visa.com
> >                                     
> >                    We respect your time and business.
> >                     It's our pleasure to serve you.
> >                                     
> >                                     
> >  Please don't reply to this email. This e-mail was generated 
> by a mail
> >                             handling system.
> >                                     
> >                                     
> >                                                 [image]
> >                                     
> > Copyright 1996-2003, Visa International Service Association. 
> All rights
> >                                                reserved.
> >                                     
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html