Hi Jelmer, I've read your analysis of the trojan of 180 solutions and noticed the statement that this issue uses two zero day exploits. I'm trying to monitor and register IE vulnerabilities and have a strong feeling I've seen the Location header execution before. Just to be sure, are you aware that: - Liu Die Yu discards the local protocol issue as a refresh issue: http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage.htm - Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the vulnerabilities uses the following statement in the example code : target.location="ms-its:\\ntshared.chm::/copyright.htm"; The posting to bugtraq can be found at : http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html
To me these issues and your URL: issue seem the same and afaik no patches for these issues had been provided. Can you proof me wrong? vriendelijke groet Bone Machine --- "hip hip hip" - The Pixies _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
