bugtraq - Re: Cross Site Scripting exploitation via malformed files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 23 Feb 2005 01:03:03 -0000
From: "http-equiv@...ite.com " <1@...ware.com>
To: <bugtraq@...urityfocus.com>
Subject: Re: Cross Site Scripting exploitation via malformed files

<!-- 

On many webmail systems, when the JPG file is downloaded, 
then the script is executed (you can play with javascript, vbscript,...) 

It was verified under IE - XP SP2 

 -->

This doesn't seem to be correct [or even work for that matter].

1. As an attachment in the email and received in yahoo or hotmail, 
generally most others, it arrives as that, an attachment [Content-
Disposition: attachment; even if inline it would fail as below], which you 
then click for download and opening. IE6 XP SP2 there is a download 
warning [as there probably is pre-SP2], which if you accept and open the 
file, opens with the defeault graphic viewer on XP Windows Picture and Fax 
Viewer. Even creating the file locally and opening it with IE directly 
generates an empty image container.

2. Pre SP2 and even XP, IE would render the html or code intentionally 
placed in basically any file type sitting on a remote server. But that is 
old and quite well known should certainly be fixed by now.

Unless of course if something new has cropped up. Has it?

-- 
http://www.malware.com