RE: File extensions spoofable in MSIE download dialog

From: Jouko Pynnonen (joukoat_private)
Date: Mon Nov 26 2001 - 10:51:11 PST

Next message: Larry W. Cashdollar: "Xitami Webserver stores admin password in clear text."

Previous message: CDE Francis: "Re: Mac Netscape password fields"
In reply to: Jonathan G. Lampe: "RE: File extensions spoofable in MSIE download dialog"
Next in thread: StatiC: "RE: File extensions spoofable in MSIE download dialog"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, 26 Nov 2001, Jonathan G. Lampe wrote:

> I could not reproduce this problem with semi-current versions of the latest
> browsers.

[snip]

> I tried the following four variations in my test:  (Comment/uncomment the
> lines!)
> 1. Bogus Content Type, No Attachment Header
> 2. octet Content Type, No Attachment Header
> 3. Bogus Content Type, Attachment Header
> 4. octet Content Type, Attachment Header

Some details needed for reproducing and exploiting the flaw were left
out of my posting because there is no good workaround or a patch
available, and the flaw could be quite easily used maliciously. Using
those details it would be relatively easy to create a worm that infects a
system when a user "opens" a plain text file from an infected website,
for instance. For the same reason there wasn't any test page URL included
in my posting. That, and technical details will be published later.

-- 
Jouko Pynnonen          Online Solutions Ltd       Secure your Linux -
joukoat_private      http://www.solutions.fi    http://www.secmod.com

Next message: Larry W. Cashdollar: "Xitami Webserver stores admin password in clear text."
Previous message: CDE Francis: "Re: Mac Netscape password fields"
In reply to: Jonathan G. Lampe: "RE: File extensions spoofable in MSIE download dialog"
Next in thread: StatiC: "RE: File extensions spoofable in MSIE download dialog"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Nov 26 2001 - 20:08:29 PST