full-disclosure - Re: [FDSA] Notepad Highly Critical Cross-Site Scripting (XSS) Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2df3b0cb0801171020l4ace0957q373f4c1b7bb64139@mail.gmail.com>
Date: Thu, 17 Jan 2008 16:20:58 -0200
From: M.B.Jr. <marcio.barbado@...il.com>
To: "Nate McFeters" <nate.mcfeters@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [FDSA] Notepad Highly Critical Cross-Site
	Scripting (XSS) Vulnerability

No,
that "fuel on the fire" was so inopportune.

A default browser setting matter, Nate.
Other programs also open it up, when set to default.


On 1/17/08, Nate McFeters <nate.mcfeters@...il.com> wrote:
> Not to through fuel on the fire, but wouldn't that XSS actually be in IE,
> since IE is what opens the file?  Could've been a funny joke though, a real
> knee slapper.
>
> Nate
>
>
> On 1/17/08, Fredrick Diggle <fdiggle@...il.com> wrote:
> >
> #######################################################################
> >
> >                             Fredrick Diggle Security
> Advisory
> >
> > Application: Notepad
> > Versions: 5.1.2600.2180 verified to be vulnerable
> > Platforms: Microsoft Windows (All Versions)
> > Bugs: Cross Site Scripting (XSS)
> > Severity: Critically High
> > Date: 17 Jan 2008
> > Credit: Estr Hinan
> >
> >
> #######################################################################
> >
> > 1) Introduction
> > 2) Bugs
> > 4) Fix
> >
> >
> #######################################################################
> >
> > ===============
> > 1) Introduction
> > ===============
> >
> > Fredrick Diggle Security Services is probably the best application
> > security researchers on the scene this month. They have identified
> > several hundred thousand vulnerabilities this week for which Priv8
> > 0dayz have been developed. Fredrick Diggle Security Team periodically
> > releases several of these vulnerabilities to the community at large
> > (Pre Vendor Release!!!!). Fred Diggle would like to ensure that you
> > understand this is 0DAY!!!. The vendors are completely unaware of this
> > vulnerabilities.
> >
> >
> #######################################################################
> >
> > =======
> > 2) Bug
> > =======
> >
> > Notepad is a utility which is built into all current versions of
> > Microsoft Windows. Notepad contains a highly exploitable stored
> > cross-site scripting vulnerability when files are saved with the
> > following extensions:
> >
> > htm
> > html
> >
> > Other extensions may also be vulnerable in your environment depending
> > on configuration. When arbitrary javascript code is entered into the
> > notepad text window and saved using one of the vulnerable extensions a
> > payload file is created. When an innocent user opens this payload file
> > cross-site scripting occurs.
> >
> >
> #######################################################################
> >
> > =======
> > 3) Proof of Concept
> > =======
> >
> > 1. Open Notepad
> > 2. Enter the following text
> > <script>alert("xss");</script>
> > 3. Save file as "exploit.html"
> > 4. double click the payload file
> >
> >
> #######################################################################
> >
> > ======
> > 4) Fix
> > ======
> >
> > Notepad should be rewritten to filter potentially dangerous
> > characters. Characters can be converted to their html encoded
> > equivalents.
> >
> >
> #######################################################################
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>


-- 
Marcio Barbado, Jr.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/