full-disclosure - [FD] MS14-080 CVE-2014-6365 Technical Details Without "Nonsense"

Open Source and information security mailing list archives

Message-ID: <54B506D5.2000603@dieyu.org>
Date: Tue, 13 Jan 2015 11:51:49 +0000
From: Diéyǔ <dieyu@...yu.org>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] MS14-080 CVE-2014-6365 Technical Details Without "Nonsense"

Origin:
Visit https://technet.microsoft.com/library/security/ms14-080
Go to "Acknowledgments" part and search for "CVE-2014-6365"
It says "Dieyu" - that's me.

Technical Details:
"Internet Explorer XSS Filter Bypass Vulnerability" is done by...
1. Inject "a href" link into target page.
(Not script, allowed by filter)
2. User clicks this injected link.
(Clickjacking etc)
3. URL of this injected link puts script into page.
(Filter does not kill it)
(Because it's transaction of the same domain)

Social Activities:
1. Greetings
David Ross "dross".
2. Hey, if you love my hacking, please reply "nice".
(I do this for free. Love to hear from my readers.)
3. My LinkedIn page: https://www.linkedin.com/in/liuzhiyong
(You can add me there! Recently I took a new name.)
4. My ultimate "flaw": http://dieyu.org/
(You know my style. Comment is welcome!)

Regards,

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives