> From: "H D Moore" <sflistat_private> > Although its definately an interesting way to compromise client-side > headers, the root is the vulnerability is the XMLHTTP component's ability > to act like a HTTP proxy. Client-side scripting components should only be > allowed to interact with the site which served them up, otherwise you > open a huge can of worms, where XSS and user-credential theft are only > the squishy little ones on top. Isn't it great then to realize that XMLHTTP, in fact, can only interact with the site which served them - exactly as you desire? The proxy features and XSS to arbitrary foreign sites examples that are demonstrated in this 'whitepaper' are merely demonstrations of already publicly known unpatched vulnerabilities in IE. They have nothing to do with any of the findings presented. http://jscript.dk/2003/1/sec/xst-reply.txt Regards Thor Larholm PivX Solutions, LLC - Senior Security Researcher Latest PivX research: Multi-vendor Game Server DDoS Vulnerability http://www.pivx.com/press_releases/mk_mk001.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Thu Jan 23 2003 - 07:30:42 PST