full-disclosure - How big is the danger of IE?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200407090133.i691Xpu02780@netsys.com>
From: larry at larryseltzer.com (Larry Seltzer)
Subject: How big is the danger of IE?

>>...the security zone model itself (well, at least its implementation in IE, etc) _is
the problem_ and can often be exploited independent of the scritping, and other active
content processing, state of the zone in which some arbitrary piece of HTML is rendered.

So you can do a cross-zone attack against the restricted zone, with all scripting and
active content disabled? I'd like to see an example of this.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@...fdavis.com