lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu Oct 20 20:33:17 2005
From: jakecoleus at yahoo.com (Jake Cole)
Subject: New (19.10.05) MS-IE Url Spoofing bug (byK-Gen)

In "Billy's" defense, this is expected in most
JavaScript-enabled browsers.

Here's a Firefox version:

<a href="http://microsoft.com"
onClick="window.setTimeout('document.write(unescape(\'%3cscript%3ewindow.location=%27http://google.com%27%3c/script%3e\'))')">Microsoft</a>

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On
Behalf Of Nick FitzGerald
Sent: Thursday, October 20, 2005 12:08 PM
To: full-disclosure@...ts.grok.org.uk
Subject: [BULK] - Re: [Full-disclosure] New (19.10.05)
MS-IE Url Spoofing bug (byK-Gen).

Mike Camden wrote:

> I thought this was by design since you may have a
known url to go to but
> only after some form of validation has been passed.

IFF that is the case, then it is an extraordinarily
brain-dead design, 
as it breaks the very critical "rule" that you should
NOT surprise the 
user.  A URL link that is shown in the interface to go
one place, but 
which goes somewhere else is fundamentally broken
under that rule.

If this is by design, then it's another case of a
feature that breaks 
Billy's admonition that security is to trump features,
so should be 
fixed.


Regards,

Nick FitzGerald



	
		
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com

Powered by blists - more mailing lists