Skip to site navigation (Press enter)
Re: [Full-Disclosure] MSIE
and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!))</span></a></span> </h1> <p class="darkgray font13"> <span class="sender pipe"><a href="/search?l=full-disclosure@lists.netsys.com&q=from:%22Berend%5C-Jan+Wever%22" rel="nofollow"><span itemprop="author" itemscope itemtype="http://schema.org/Person"><span itemprop="name">Berend-Jan Wever</span></span></a></span> <span class="date"><a href="/search?l=full-disclosure@lists.netsys.com&q=date:20041107" rel="nofollow">Sun, 07 Nov 2004 18:20:55 -0800</a></span> </p> </div> <div itemprop="articleBody" class="msgBody"> <!--X-Body-of-Message--> <pre>Hmmm... MSDN DHTML Reference mentions 6 different flavors of the NAME property: 1) For a lot of tags like A, APPLET, IMG, INPUT, etc... this includes EMBED 2) FRAME, FRAMESET, IFRAME 3) META 4) namespace 5) PARAM 6) window</pre><pre> I figured all the tags mentioned under 2 were affected and the rest wasn't. Now I hear <EMBED> is also working ? Somebody might wanna go through each and every tag to see which are affected and which aren't. SHDOCVW.DLL version 6.0.2800.1400 and 6.0.2800.1584 are known to be vulnerable. SHDOCVW.DLL version 6.00.2900.2518 seems to be immune to the BoF (ships with XP PRO SP2). The immune version got me wondering if they knew about the bug ? If not, did they expect the code could be buggy and just rewrote it to be sure it was safe for SP2 ? Or was there just a code rewrite or another reason why the bug got silently fixed...? I hope they fixed it by accident, seeing what the other option would imply. Cheers, SkyLined ----- Original Message ----- From: "Menashe Eliezer" <[EMAIL PROTECTED]> To: "Berend-Jan Wever" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Sunday, November 07, 2004 23:21 Subject: RE: [Full-Disclosure] MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!)) > The published exploit is working also with the <EMBED> tag, and not just > with the <IFRAME> and the <FRAME> tags. > Finjan's advisory can be found at: > <a href="http://www.finjan.com/SecurityLab/AttackandExploitReports/alert_show.asp">http://www.finjan.com/SecurityLab/AttackandExploitReports/alert_show.asp</a> > ?attack_release_id=114 > > == > Regards, > Menashe Eliezer > Senior application security architect > Malicious Code Research Center > Finjan Software > <a href="http://www.finjan.com/mcrc">http://www.finjan.com/mcrc</a> > > Prevention is the best cure! > > > > -----Original Message----- > From: morning_wood [<a href="mailto:[EMAIL">mailto:[EMAIL</a> PROTECTED] > Sent: Tuesday, November 02, 2004 3:44 PM > To: Berend-Jan Wever; [EMAIL PROTECTED]; > [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] MSIE <IFRAME> and <FRAME> tag NAME > property bufferoverflow PoC exploit (was: python does mangleme (with IE > bugs!)) > > bindshell success ( html run from local ) connect from remote success... > this is NASTY > if shellcode modified this will do reverse or exe drop i assume.... > > good work, > > Donnie Werner > > > ----------------------------------------------- > This message was scanned for malicious content and viruses by Finjan Internet > Vital Security 1Box(tm) > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: <a href="http://lists.netsys.com/full-disclosure-charter.html">http://lists.netsys.com/full-disclosure-charter.html</a> > _______________________________________________ Full-Disclosure - We believe in it. Charter: <a href="http://lists.netsys.com/full-disclosure-charter.html">http://lists.netsys.com/full-disclosure-charter.html</a> </pre> </div> <div class="msgButtons margintopdouble"> <ul class="overflow"> <li class="msgButtonItems"><a class="button buttonleft " accesskey="p" href="msg25501.html">Previous message</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="c" href="thrd15.html#25502">View by thread</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="i" href="mail15.html#25502">View by date</a></li> <li class="msgButtonItems textalignright"><a class="button buttonright " accesskey="n" href="msg25505.html">Next message</a></li> </ul> </div> <a name="tslice"></a> <div class="tSliceList margintopdouble"> <ul class="icons monospace"> <li class="icons-email"><span class="subject"><a href="msg25505.html">Re: [Full-Disclosure] MSIE <IFRAME> and <FR...</a></span> <span class="sender italic">Berend-Jan Wever</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25505.html">Re: [Full-Disclosure] MSIE <IFRAME> and &...</a></span> <span class="sender italic">patryn</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25524.html">Re: [Full-Disclosure] MSIE <IFRAME> a...</a></span> <span class="sender italic">Valdis . Kletnieks</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25536.html">Re: [Full-Disclosure] MSIE <IFRAME&g...</a></span> <span class="sender italic">Jim Geovedi</span></li> </ul></li> </ul></li> <li class="icons-email"><span class="subject"><a href="msg25538.html">Re: [Full-Disclosure] MSIE <IFRAME> and &...</a></span> <span class="sender italic">Georgi Guninski</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25542.html">Re: [Full-Disclosure] MSIE <IFRAME> a...</a></span> <span class="sender italic">pachiderme pachiderme</span></li> </ul> </ul> </ul> </div> <div class="overflow msgActions margintopdouble"> <div class="msgReply" > <h2> Reply via email to </h2> <form method="POST" action="/mailto.php"> <input type="hidden" name="subject" value="Re: [Full-Disclosure] MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!))"> <input type="hidden" name="msgid" value="004d01c4c530$4f45c0d0$0100a8c0@grotedoos"> <input type="hidden" name="relpath" value="full-disclosure@lists.netsys.com/msg25502.html"> <input type="submit" value=" Berend-Jan Wever "> </form> </div> </div> </div> <div class="aside" role="complementary"> <div class="logo"> <a href="/"><img src="/logo.png" width=247 height=88 alt="The Mail Archive"></a> </div> <form class="overflow" action="/search" method="get"> <input type="hidden" name="l" value="full-disclosure@lists.netsys.com"> <label class="hidden" for="q">Search the site</label> <input class="submittext" type="text" id="q" name="q" placeholder="Search full-disclosure"> <input class="submitbutton" name="submit" type="image" src="/submit.png" alt="Submit"> </form> <div class="nav margintop" id="nav" role="navigation"> <ul class="icons font16"> <li class="icons-home"><a href="/">The Mail Archive home</a></li> <li class="icons-list"><a href="/full-disclosure@lists.netsys.com/">full-disclosure - all messages</a></li> <li class="icons-about"><a href="/full-disclosure@lists.netsys.com/info.html">full-disclosure - about the list</a></li> <li class="icons-expand"><a href="/search?l=full-disclosure@lists.netsys.com&q=subject:%22Re%5C%3A+%5C%5BFull%5C-Disclosure%5C%5D+MSIE+%3CIFRAME%3E+and+%3CFRAME%3E+tag+NAME+property+bufferoverflow+PoC+exploit+%5C%28was%5C%3A+python+does+mangleme+%5C%28with+IE+bugs%5C%21%5C%29%5C%29%22&o=newest&f=1" title="e" id="e">Expand</a></li> <li class="icons-prev"><a href="msg25501.html" title="p">Previous message</a></li> <li class="icons-next"><a href="msg25505.html" title="n">Next message</a></li> </ul> </div> <div class="listlogo margintopdouble"> </div> <div class="margintopdouble"> </div> </div> </div> <div class="footer" role="contentinfo"> <ul> <li><a href="/">The Mail Archive home</a></li> <li><a href="/faq.html#newlist">Add your mailing list</a></li> <li><a href="/faq.html">FAQ</a></li> <li><a href="/faq.html#support">Support</a></li> <li><a href="/faq.html#privacy">Privacy</a></li> <li class="darkgray">004d01c4c530$4f45c0d0$0100a8c0@grotedoos</li> </ul> </div> </body> </html>