full-disclosure - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031211210704.GD29492@sparky.finchhaven.net>
From: jsage at finchhaven.com (John Sage)
Subject: Re: Internet Explorer URL parsing vulnerability

On Thu, Dec 11, 2003 at 07:20:14PM +0000, petard wrote:
> From: petard <petard@...eshell.org>
> To: full-disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] Re: Internet Explorer URL parsing vulnerability
> User-Agent: Mutt/1.4.1i
> Date: Thu, 11 Dec 2003 19:20:14 +0000
> 
> On Thu, Dec 11, 2003 at 11:49:07AM -0600, Schmehl, Paul L wrote:
> > Hey, I like that one.  That's the first time I've even been to slashdot
> > and see www.microsoft.com in the address bar.  :-)
> >  
> It gets better... it works with SSL sites as well. The little lock, and
> no warning message:
> http://petard.freeshell.org/hotmail-pr.html

It's interesting to note that, for Opera 7.11 under Linux, not only
does Opera return a dialog box asking for confirmation, but that in
the title bar the 0x01 is actually displayed at its proper location in
the URL...

(see attached 0x01_url_before.png)


Upon confirming the dialog, Opera displays the following in the
address bar:

https://www.hotmail.com @www.hushmail.com/

with an actual gap of some sort between the www.hotmail.com and the @
thus:

(see attached 0x01_url_after.png)



- John
-- 
"Most people don't type their own logfiles;  but, what do I care?"
-
John Sage: InfoSec Groupie
-
ABCD, EFGH, IJKL, EmEnOh, Pplus+, Mminus-
-
ATTENTION: this entire message is privileged communication, intended
for the sole use of its recipients only. If you read it even though
you know you aren't supposed to, you're a poopy-head.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0x01_url_before.png
Type: image/png
Size: 18924 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031211/b155f54d/0x01_url_before.png
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0x01_url_after.png
Type: image/png
Size: 25560 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031211/b155f54d/0x01_url_after.png