bugtraq - AIM Local File Display in Notification Window

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 14 Sep 2007 10:51:33 -0500 (CDT)
From: shell@...shell.net
To: bugtraq@...urityfocus.com
Subject: AIM Local File Display in Notification Window

Upon further exploration of our previous bug, I discovered that the
rendered HTML was even capable of displaying local files. Specifically,
<img src="C:/WINDOWS/Zapotec.bmp"> was able to display the file from the
Windows directory without question. We further experimented with this and
tried including large files from the windows directory (ex. shell32.dll)
as scripts (ex. <script src=...) in attempt to overflow the buffer.
However, these attempts yielded no success.

Discovery credited to:
Shell ( dotshell.net, shell6@...il.com, shell@...shell.net)
Lone (Lone-Matrix.com, Lone@...e-Matrix.com)