Re: .MHT Buffer Overflow in Internet Explorer

From: http-equivat_private
Date: Tue Mar 11 2003 - 09:13:21 PST

  • Next message: Peter Kruse: "[VulnWatch] SOHO Routefinder 550 VPN, DoS and Buffer Overflow"

    <!-- 
    The following sample format contains malformed MIME header along with 
    the Base64 encoded executable. 
    
    ---------------------------------------------- 
    MIME-Version: 1.0 
    ------=_NextPart_000_0000_01C2E1F4.0D559EA0 
    Content-Location:file:///tomatell.exe 
    Content-Transfer-Encoding: base64 
    
    
    TVpQ 
    ---------------------------------------------- 
    
    
     -->
    
    Excellent!
    
    Yes, there has always been something suspicious about that spot. 
    Simply writing the word [header] GIF89a in the same spot will create 
    an empty image container:
    
    ------phuquedup.mhtml-----
    
    MIME-Version: 1.0 
    Content-Transfer-Encoding: 7bit 
    
    GIF89a
    
    ------phuquedup.mhtml-----
    
    
    
    End Call
    
    -- 
    http://www.malware.com
    



    This archive was generated by hypermail 2b30 : Tue Mar 11 2003 - 11:46:04 PST