RE: Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing

From: Richard M. Smith (rmsat_private)
Date: Thu Oct 11 2001 - 11:18:55 PDT

Next message: Murat Balaban: "Buffer Overflows Paper in Turkish."

Previous message: Brett Glass: "Re: INCIDENT: WebCertificate.com hacked"
In reply to: kikkert security: "Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing"
Next in thread: j jf: "RE: Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I just checked in IE6 and it looks like the "medium" security level is
the default setting for the Intranet zone.  This is the same default as
the Internet zone.  Seems to me that if IE4 and IE5 have the same
default, then this bug is not going to affect very many people.  I
suspect that most folks don't change the settings on the Intranet zone.

An interesting discovery nevertheless.

Richard

-----Original Message-----
From: kikkert security [mailto:unhackablesat_private] 
Sent: Thursday, October 11, 2001 5:38 AM
To: bugtraqat_private; FOCUS-MSat_private
Subject: Serious security Flaw in Microsoft Internet Explorer - Zone
Spoofing


Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing

------
Risk: POTENTIALLY HIGH.
Potentially allowing any possible action on the client machine,
including 
reading any file, placing Trojan code or altering data.
The risk depends on the security settings in the 'Intranet zone'.

Next message: Murat Balaban: "Buffer Overflows Paper in Turkish."
Previous message: Brett Glass: "Re: INCIDENT: WebCertificate.com hacked"
In reply to: kikkert security: "Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing"
Next in thread: j jf: "RE: Serious security Flaw in Microsoft Internet Explorer - Zone Spoofing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Oct 11 2001 - 13:33:51 PDT