Re: Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML

["bitlance winter" <bitlance_3 () hotmail com>]

Dear 3APA3A.
Thank you for your excelent information.

> offtopic, 3APA3A. Bypassing client application protection techniques
> http://www.security.nnov.ru/advisories/bypassing.asp

> 3APA3A. Bypassing content filtering whitepaper
> http://www.security.nnov.ru/advisories/content.asp

These advisories are very very cool. ;)

By the way, I have checkouted these Test descriptions.
http://www.security.nnov.ru/files/opossum/test4.gif
http://www.security.nnov.ru/files/opossum/test5.gif

IE6 on Windows XPSP2 introduces a new setting under
Tools->Internet Options->Security settings
where we can choose to
"Disable Open files based on content, not file extension" .

Choosing Disable will make Internet Explore respect
the Content Type at least in some circumstances.

When we choose to Disable,
neither opossum/test4.gif  nor opossum/test5.gif are dangerous.
But the script kitty is still dangerous. I am confused. :(

(Unfortunately, this setting is not disabled by default in Internet Zone.)

Thank you.

Reference:
Setting Changes in Service Pack 2
#MIME Sniffing File-Type Elevation
http://www.microsoft.com/resources/documentation/ie/6/all/reskit/en-us/appendix.mspx

Content Types - Web Developer Boot Camp
http://bclary.com/2004/09/26/boot-camp-content-type

FILE SIGNATURES TABLE
http://www.garykessler.net/library/file_sigs.htm

--
bitlance winter

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html