lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20031209171957.7977.qmail@sf-www3-symnsj.securityfocus.com>
Date: 9 Dec 2003 17:19:57 -0000
From: <soulshok@...pie.dk>
To: bugtraq@...urityfocus.com
Subject: Re: Internet Explorer URL parsing vulnerability


In-Reply-To: <20031209144416.31613.qmail@...www2-symnsj.securityfocus.com>

># Exploit ##########
>By opening a window using the http://user@...ain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character.
>Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. 
...
># Tested ##########
>Internet Explorer
>Version 6.0.2800.1106C0
>Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>
Internet Explorer 5.00.3700.1000 (SP4, Q824145) doesn't seem to be vunlerable to this.


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ