full-disclosure - Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B34480AA48044FF9175D220D8958A3F@control3>
Date: Sun, 7 Oct 2007 01:40:32 -0400
From: "Geo." <geoincidents@....net>
To: <bugtraq@...urityfocus.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: URI handling woes in Acrobat Reader, Netscape,
	Miranda, Skype

----- Original Message ----- 
From: "Thierry Zoller" <Thierry@...ler.lu>

> The user clicks on a mailto link, is that untrusted code?

Depends on where the link comes from. If it's a shortcut on the users 
desktop no it's not untrusted, if it's in a PDF file you received in your 
email then yes it's untrusted.

> Anyways, the mailto link
> POST IE7 has a flaw/threat/vulnerablity it hasn't had PRE IE7.

> The problem here is the root cause, the root cause is that IE7

Ok I'm game, so then show me this exploit without having Acrobat on your 
system. IE7 handles mailto links in untrusted web pages. Put the mailto link 
in an untrusted html page and make it work with IE7.

Geo. 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/