lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 9 Oct 2007 16:29:01 +1300 From: "Brett Moore" <brett.moore@...omniasec.com> To: "'Morning Wood'" <se_cur_ity@...mail.com> Cc: "'Thierry Zoller'" <Thierry@...ler.lu>, <bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk> Subject: RE: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Hey. I've been waiting to see when somebody finally got around to testing Outlook express. It's also possible to exploit this through Outlook full version from office 2003. I have also discovered other problems (not difficult to fine) which allows the execution of any program which has registered as a document handler, with the URL been passed to it. This gets interesting when the local application has problems such as a command line buffer overflow. I'm guessing this is similar to what has been documented here. http://xs-sniper.com/blog/2007/09/01/firefox-file-handling-woes/ .brett On 10/8/07, Morning Wood <se_cur_ity@...mail.com> wrote: > these work inside OE, default with html turned off > they do not work when clicked from a normal > local html. > > ----- Original Message ----- > From: "Thierry Zoller" <Thierry@...ler.lu> > To: <bugtraq@...urityfocus.com>; <full-disclosure@...ts.grok.org.uk> > Sent: Saturday, October 06, 2007 8:06 AM > Subject: Re: [Full-disclosure] URI handling woes in Acrobat Reader, > Netscape,Miranda, Skype > > > > Dear All, > > > > mailto:test%../../../../windows/system32/calc.exe".cmd > > I would deem 1 and 3 as resonable (intented) behaviour. > > > >>2) now do the very same thing on a system with Windows XP and IE7. > >>calc.exe is executed. > > Confirmed here, that's definately a Problem, and should be linked to > > the Windows URI Handler. (IMHO) > > > > > > The behaviour is this : > > The extension determines the handler to use to shell > > "../../../../windows/system32/calc.exe" > > > > Example : > > mailto:test%../../../../windows/system32/calc.exe".cmd > > Usese the cmd handler to open calc (which executes) > > > > mailto:test%../../../../windows/system32/calc.exe".txt > > uses notepad and tries to open calc. > > > > Somethings definately broken with the URI handler (imho) > > > > > > -- > > http://secdev.zoller.lu > > Thierry Zoller > > Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7 > > > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
Powered by blists - more mailing lists