Some HTML browsers can be tricked through the use of HTML forms into sending more or less arbitrary data to any TCP port. This can be used to send commands to servers using ASCII based protocols like SMTP, NNTP, POP3, IMAP, IRC, and probably others. By sending HTML email to unsuspecting users or using a trojan HTML page, an attacker might be able to send mail or post Usenet News through servers normally not accessible to him. In special cases an attacker might be able to do other harm, e.g. deleting mail from a POP3 mailbox. In most situations this attack would not be considered a big problem, but it is an interesting example on how the combination of several innocuous and seemingly totally unrelated protocol features can be used to mount an attack. A paper describing this "HTML Form Protocol Attack" is available at http://www.remote.org/jochen/sec/hfpa/index.html The Postscript version is attached to this mail. Jochen
This archive was generated by hypermail 2b30 : Wed Aug 15 2001 - 07:30:31 PDT