full-disclosure - Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: bitlance_3 at hotmail.com (bitlance winter)
Subject: Possible XSS issue on Windows XPSP2 IE6 via MIME
	Encapsulation of Aggregate HTML

Dear 3APA3A.
Thank you for your excelent information.

>offtopic, 3APA3A. Bypassing client application protection techniques
>http://www.security.nnov.ru/advisories/bypassing.asp

>3APA3A. Bypassing content filtering whitepaper
>http://www.security.nnov.ru/advisories/content.asp

These advisories are very very cool. ;)

By the way, I have checkouted these Test descriptions.
http://www.security.nnov.ru/files/opossum/test4.gif
http://www.security.nnov.ru/files/opossum/test5.gif

IE6 on Windows XPSP2 introduces a new setting under
Tools->Internet Options->Security settings
where we can choose to
"Disable Open files based on content, not file extension" .

Choosing Disable will make Internet Explore respect
the Content Type at least in some circumstances.

When we choose to Disable,
neither opossum/test4.gif  nor opossum/test5.gif are dangerous.
But the script kitty is still dangerous. I am confused. :(

(Unfortunately, this setting is not disabled by default in Internet Zone.)

Thank you.

Reference:
Setting Changes in Service Pack 2
#MIME Sniffing File-Type Elevation
http://www.microsoft.com/resources/documentation/ie/6/all/reskit/en-us/appendix.mspx

Content Types - Web Developer Boot Camp
http://bclary.com/2004/09/26/boot-camp-content-type

FILE SIGNATURES TABLE
http://www.garykessler.net/library/file_sigs.htm

--
bitlance winter

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/