| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20071025155816.9020.qmail@securityfocus.com> Date: 25 Oct 2007 15:58:16 -0000 From: laurent.gaffie@...il.com To: bugtraq@...urityfocus.com Subject: Re: Re: RE: playing for fun with <=IE7 Hi there Nop it wont work. http://dams083.free.fr/tmp/putty.exe?explorer.exe the first .exe extension will be overwriten by the second one . then it will be putty.exe anyways. "avivra" did mention that he was able to use this bypass to automate the PDF attack vector found by GNUCitizen's pdp http://aviv.raffon.net/2007/10/15/BackFromTheDead.aspx he also did mention that cyber_flash found the same kind of vuln on IE6 sp2 3 years ago. thanks to him for theses precisions. i was also able to reproduce the pdp(gnucitizen) pdf 0days remotly without any promt with IE7 using the avivra idea/exemple showed on his video here's a live exemple: http://dams083.free.fr/pdf_poc.exe?1.pdf pdf is open , calc.exe is launched no promt . we can imagine the impact with a: -permanent Xss -malicious webpage -worm -etc regards laurent gaffié //sorry for the delay.
Powered by blists - more mailing lists