bugtraq - Re: ipb Css bug(now public)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 08 Aug 2005 21:04:17 +0200
From: Nicolas Gregoire <ngregoire@...probe.com>
To: mattmecham@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re: ipb Css bug(now public)

Le lundi 08 août 2005 à 13:12 +0000, mattmecham@...il.com a écrit :

> While IPB < 1.3 *might* have been vulnerable, IPB 2.x definitely isn't
> as HTML files are saved with the mime-type "unknown/unknown" which
> prompts the user to download the file to their desktop making it
> totally safe.

<not tested>
That may be not true for users using (at least) Internet Explorer, as
"MIME-type sniffing" will be used to determine the file type (and
handler) to use when opening the file.
</not tested>

That's what happen in some Oracle web pages sent with "text/plain" and
vulnerable to a text/code/JS injection. Oracle isn't to blame (really ?)
but the browser (if IE) will execute the JavaScript code. 

Regards,
-- 
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
ngregoire@...probe.com ------[ ExaProbe ]------ http://www.exaprobe.com/
PGP KeyID:CA61B44F  FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B44F