Full Disclosure mailing list archives
RE: [Full-Disc]: Xmas virus on the cards ?
From: "Rainer Gerhards" <rgerhards () hq adiscon com>
Date: Thu, 18 Dec 2003 16:56:56 +0100
I noticed this article at http://www.vnunet.com/News/1151553 and it looks alarming - however did not find any more details.To me, it sounds like someone has misunderstood the "social engineering" of an URL that seems to lead to a picture... http://www.somedomain.com/picture.jpg Where "picture.jpg" is in fact a folder, not a file, so, a "normal" HTML page is sent to the browser instead.
I just did a quick test. This works with executables quite well, too. I used IIS, created a directory test.jpg, placed notepad.exe in it and configured iis to use "notepad.exe" as default page. Interestingly, in IE I not only received a warning but the file was also not executable - I guess a little playing with the IIS mime map could "fix" this. In Opera, I got a decent warning (even showing the correct file name) and when I selected to "open" the file, I executed it. I did not do any specific test, just a 2 minute try.
Aka, nothing to care about or filter at all, except trying to keep your browser as safe as possible, to prevent exploits in the HTML-page.
I am not sure... this sounds indeed like a different quality. The orginal poster told about html emails. I guess there can be done some "fun" with this... Rainer _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: [Full-Disc]: Xmas virus on the cards ? John . Airey (Dec 18)
- <Possible follow-ups>
- RE: [Full-Disc]: Xmas virus on the cards ? Rainer Gerhards (Dec 18)
- RE: [Full-Disc]: Xmas virus on the cards ? Rainer Gerhards (Dec 18)