Full Disclosure mailing list archives
Re: Yet another reason not to use IE! Old news?
From: "Lise Moorveld" <lise_moorveld () hotmail com>
Date: Wed, 11 Aug 2004 10:59:17 +0200
Hi,
Just visited a well known site (Wired.com) and had a nice little piece of code cause the page that I was reading to go blank DNS error page. Heres the offending code (parentheses instead of slashes to not cause AV scanning issues) and thank God I wasnt using XP:ms-its:c:((windows(Help(iexplore.chm::)iegetsrt.htm
Correct me if I'm wrong, but the only thing this bit of code does is open a local file taken from a local CHM file. Jelmer mentioned this bit of code in his recent analysis: http://62.131.86.111/analysis.htm Apparently, the trick is that it is opened in the Local Computer Zone and that, if you know a cross-zone scripting vulnerability, you can inject malicious scripting code into the local file and have it executed in the security context of the Local Computer Zone. So what would be really interesting is finding the code in the banner that performs the cross-zone scripting. Also, in the analysis of Jelmer, the local file is opened using the Location: header. I'm not sure what it means if a banner can alter headers? Would it mean the banner server is compromised? Any ideas anyone? -- Lise _________________________________________________________________Hotmail en Messenger on the move http://www.msn.nl/communicatie/smsdiensten/hotmailsmsv2/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: SP2 is killing me. Help?, (continued)
- Re: SP2 is killing me. Help? Georgi Guninski (Aug 12)
- Re: SP2 is killing me. Help? Harlan Carvey (Aug 12)
- Re: SP2 is killing me. Help? Maarten (Aug 12)
- Re: SP2 is killing me. Help? Valdis . Kletnieks (Aug 13)
- Re: SP2 is killing me. Help? Ron DuFresne (Aug 18)
- RE: SP2 is killing me. Help? joe (Aug 12)
- RE: SP2 is killing me. Help? xtrecate (Aug 12)
- RE: SP2 is killing me. Help? Phillip R. Paradis (Aug 12)
- Re: SP2 is killing me. Help? Luke Lussier (Aug 13)
- Re: SP2 is killing me. Help? Shannon Johnston (Aug 13)