From: Paul Szabo (pszmaths.usyd.edu.au)
Date: Sat Oct 25 2003 - 16:20:10 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Thor Larholm <thorPIVX.COM> wrote:

> ... this is not a problem with Microsofts Internet Explorer, but ...
> There are two completely new issues at hand here.
> The second issue is that IE ... inadvertently redirects to a local file ...
> Content-Location: file:///c:/somefile.html
> ... circumvents the initial restriction ... on all local protocols,
> such as file:// and res:// ...

How is that not an IE problem? Do all MS apologist self-contradict?

> Being able to store arbitrary content in a known location is vital to
> any of the current range of IE exploits. ...
> A similar issue ... has been found on several occasions where a
> third-party non-Microsoft application allows you to store arbitrary
> content in a known location. ...
> In summary, when Macromedia changes their Flash player to no longer
> store Flash cookies in plaintext in a known location, this will no
> longer be an issue. ... I doubt we will see any malicious use of the
> local file redirection variation you found.

My favourite store-arbitrary-local-file application is Eudora: it
pre-extracts attachments into files in a known location.

Cheers,

Paul Szabo - pszmaths.usyd.edu.au http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics University of Sydney 2006 Australia

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]