full-disclosure - Re: Windows .ANI LoadAniIcon Stack Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 03 Apr 2007 19:53:42 -0700
From: Alexander Sotirov <asotirov@...ermina.com>
To: Larry Seltzer <Larry@...ryseltzer.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Windows .ANI LoadAniIcon Stack Overflow

Larry Seltzer wrote:
>>> Larry, why are you so curious about how this exploit works? 
> 
> Because the Firefox docs say they don't support ANI files for cursors
> and I can't get any non-malicious ones to work in it. I have to admit
> I'm having trouble getting them to work in IE now too.

That's correct, Firefox doesn't support ANI files for cursors. If the
exploitation method was so obvious, we would already have Firefox exploits in
the wild, wouldn't we?

> What's wrong with this code?
> 
> <HTML>
> <BODY>
> <style type="text/css">
> BODY{cursor: url(http://www.larryseltzer.com/DRUM.ANI);}
> </style>

Maybe the url should be in quites? This works for me:
<body style="CURSOR: url('foo.ani')">

Alex

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/