bugtraq - Re: Exploit in IE6,7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 29 Jan 2008 11:25:42 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: Exploit in IE6,7

r2t@...mail.it wrote:

> Discovred By : Hasadya Raed
> E-mail : r2t@...mail.it , Hacker_Web@...n
> -----------------------------------------
> Exploit : Internet Explorer 6,7
> -----------------------------------------
> Code : 
<<yawn...>> 

Nothing new here, move along please...

This is an old, and once commonly-used in the wild, implementation of 
the so-called "MDAC vulnerability" patched in MS06-014.

Some trivial Googling turns up instances of this precise code being 
discussed in online fora in July 2006.

Repeating oneself:

> Discovred By : Hasadya Raed

Hasadya:

In what meaningful sense did you "discovr" this?

Why do you think we might care?

And do you have you any idea of whether and/or how it actually works?

Regards,

Nick FitzGerald