bugtraq - Re: Webmails + Internet Explorer can create unwanted javascript execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20031003191656.GA19128@c9x.org>
Date: Fri, 3 Oct 2003 21:16:34 +0200
From: Jedi/Sector One <j@...eftpd.org>
To: Jason Munro <jason@...bev.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Webmails + Internet Explorer can create unwanted javascript execution

On Fri, Oct 03, 2003 at 11:56:47AM -0500, Jason Munro wrote:
> While squirrelmail's filter is based on the same engine apparently either
> it's not up to date or the params are not set as tight.

  It looks like Squirrelmail 1.4.0 doesn't filter it, while 1.4.2 does.

  Upgrading Squirrelmail is not a bad idea anyway, as before version 1.4.1, 
external images could be loaded through the "lowsrc" attribute on browsers
that handle it. But this was not a bug in Squirrelmail either, just a
combination to avoid.