full-disclosure - New IE sploit?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <44279379.9090105@gecadtech.com>
Date: Mon Mar 27 08:25:57 2006
From: stelian.ene at gecadtech.com (Stelian Ene)
Subject: New IE sploit?

Bart.Lansing@...ls.com wrote:
> 
> 
> This will handle the announced sploit...assuming you do snort, courtesy
> of Bleeding-Snort:
> 
> http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/sigs/EXPLOIT/EXPLOIT_IE_Vulnerabilities?view=markup
> 

This will handle the specific variation used in that exploit, but blocking this
completely is outside the scope of snort and most content scanners.
I see that even text/plain mails talking about the bug are "cleaned" by major
AVs. This is especially brain-dead behavior since all advisories clearly say
email is not a vector.
Due to the nature of JS, there are almost endless variations. Off the top of my
head:
- getElementById is not necessary; for example, use getElementsByName
- checkbox/radio + createTextRange is not the only way of triggering the bug
- infinite obfuscation using eval()
- infinite obfuscation using document.write()