Full Disclosure mailing list archives
Re: Microsoft's Binary Planting Clean-Up Mission
From: "ACROS Security Lists" <lists () acros si>
Date: Fri, 16 Sep 2011 10:24:16 +0200
Hi Paul, These two changes have been introduced earlier (sometime between April and August). We haven't noticed any mention of them in Microsoft's public documents. Cheers, Mitja
-----Original Message----- From: paul.szabo () sydney edu au [mailto:paul.szabo () sydney edu au] Sent: Friday, September 16, 2011 2:21 AM To: full-disclosure () lists grok org uk; lists () acros si Subject: Re: [Full-disclosure] Microsoft's Binary Planting Clean-Up Mission Dear Mitja, In your blog http://blog.acrossecurity.com/2011/09/microsofts-binary-planti
ng-clean-up.html
you wrote: Change #1: No "file://" Inside "http://" Microsoft changed the behavior of Internet Explorer such that a web page (served via http://) can't display the content of a shared folder (served via file://) in a frame/iframe. This is good ... Change #2: No "file://" From "http://" Not allowing a web page loaded via http:// to open a file:// URL blocks this attack vector and this is good. ... When were those IE changes made: as part of MS11-057 maybe? I could not find any references to such a change. Thanks, Paul Paul Szabo psz () maths usyd edu au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Microsoft's Binary Planting Clean-Up Mission, (continued)
- Re: Microsoft's Binary Planting Clean-Up Mission Michael Schmidt (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission Jeffrey Walton (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission ACROS Security Lists (Sep 15)
- Re: Microsoft's Binary Planting Clean-Up Mission Mikhail A. Utin (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission Pedro B (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission ACROS Security Lists (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission Stefan Kanthak (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission Tyler Borland (Sep 15)
- Re: Microsoft's Binary Planting Clean-Up Mission Thor (Hammer of God) (Sep 16)
- Re: Microsoft's Binary Planting Clean-Up Mission ACROS Security Lists (Sep 16)