full-disclosure - [sb] RE: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: bonemach at sdf.lonestar.org (BoneMachine)
Subject: [sb] RE: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

Hi Jelmer, 
I've read your analysis of the trojan of 180  solutions and noticed the statement that this issue uses two zero day exploits.
I'm trying to monitor and register IE vulnerabilities and have a strong feeling I've seen the Location header execution before. 
Just to be sure, are you aware that:
- Liu Die Yu discards the local protocol issue as a refresh issue:
http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage.htm
- Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the vulnerabilities uses the following statement in the example code :
target.location="ms-its:\\ntshared.chm::/copyright.htm";
The posting to bugtraq can be found at : http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html

To me these issues and your URL: issue seem the same and afaik no patches for these issues had been provided. 

Can you proof me wrong?

vriendelijke groet
Bone Machine

---
"hip hip hip" - The Pixies