KxvgcpWGz3LLqQ1YtmLM7SuGgHayUq5ny6AlTMoYI0ZUMD8R9rVyRSM+CTMkQx
irskV/2HbqmrA4K1BdTV59t6n96lA955KaQMfKChxjk/YmQuBb/77DO+UABEWpdE
N3Sq2OgZOZxElLdBP3Yq/+sei6ixxH3g0UoAH+nOTTvYZDaizMWOPDnhVcwyx6mC
R0lXp70xSB8OvUo89e27eLXz/FYmNBpv54b5gKGJ6HTzxl0YjjeolQ==
=Uzha
-----END PGP SIGNATURE-
-Original Message
>The exploit allows an attacker to use any JavaScript-enabled web
>browser behind a firewall to retrive content from (HTTP GET) and
>interact with (HTTP POST) any HTTP server behind the
>firewall. If the client in use is Microsoft Internet Explorer 5.0+,
>Mozilla, or Netscape 6.2+, the attacker c
On Mon, Jul 29, 2002 at 10:57:11AM -0700, Adam Megacz wrote:
> Exploit
>
> 1) Attacker controls DNS zone *.baz.com, configuring it as follows:
>
> a) foo.bar.baz.com -> some web server operated by the attacker
> b) bar.baz.com -> 10.0.0.9 (some address behind BigCo's firewall)
==
XWT Foundation Security Advisory
Adam Megacz <[EMAIL PROTECTED]>
http://www.xwt.org/sop.txt
29-Jul-2002 [Public Release]
__
Abstract
The fo
