bugtraq - RE: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001001c80a24$89ed4d70$9dc7e850$@moore@insomniasec.com>
Date: Tue, 9 Oct 2007 16:29:01 +1300
From: "Brett Moore" <brett.moore@...omniasec.com>
To: "'Morning Wood'" <se_cur_ity@...mail.com>
Cc: "'Thierry Zoller'" <Thierry@...ler.lu>,
	<bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk>
Subject: RE: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype

Hey.

I've been waiting to see when somebody finally got around to testing
Outlook express. 

It's also possible to exploit this through Outlook full version from
office 2003. 

I have also discovered other problems (not difficult to fine) which
allows the execution of any program which has registered as a 
document handler, with the URL been passed to it. 

This gets interesting when the local application has problems such
as a command line buffer overflow.

I'm guessing this is similar to what has been documented here.
 http://xs-sniper.com/blog/2007/09/01/firefox-file-handling-woes/

.brett


On 10/8/07, Morning Wood <se_cur_ity@...mail.com> wrote:
> these work inside OE, default with html turned off
> they do not work when clicked from a normal
> local html.
> 
> ----- Original Message -----
> From: "Thierry Zoller" <Thierry@...ler.lu>
> To: <bugtraq@...urityfocus.com>; <full-disclosure@...ts.grok.org.uk>
> Sent: Saturday, October 06, 2007 8:06 AM
> Subject: Re: [Full-disclosure] URI handling woes in Acrobat Reader,
> Netscape,Miranda, Skype
> 
> 
> > Dear All,
> >
> > mailto:test%../../../../windows/system32/calc.exe".cmd
> > I would deem 1 and 3 as resonable (intented) behaviour.
> >
> >>2) now do the very same thing on a system with Windows XP and IE7.
> >>calc.exe is executed.
> > Confirmed here, that's definately a Problem, and should be linked to
> > the Windows URI Handler. (IMHO)
> >
> >
> > The behaviour is this :
> > The extension determines the handler to use to shell
> > "../../../../windows/system32/calc.exe"
> >
> > Example :
> > mailto:test%../../../../windows/system32/calc.exe".cmd
> > Usese the cmd handler to open calc (which executes)
> >
> > mailto:test%../../../../windows/system32/calc.exe".txt
> > uses notepad and tries to open calc.
> >
> > Somethings definately broken with the URI handler (imho)
> >
> >
> > --
> > http://secdev.zoller.lu
> > Thierry Zoller
> > Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>