Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-Disclosure] Another IE trick (Re: IE sucks : sun java virtual machine insecure tmp file creation)
From: 3APA3A (3APA3ASECURITY.NNOV.RU)
Date: Fri Jul 09 2004 - 11:41:58 CDT
Dear Eric Paynter,
Yes, it's possible and I always recommend to deny execution in user's
profile and home directory. But HTML file doesn't need execute
permission to open. Of cause, in this case then trojan gets executed
it's harder to infect system, but it's still possible to steal some
--Friday, July 9, 2004, 8:26:23 PM, you wrote to full-disclosurelists.netsys.com:
EP> On Fri, July 9, 2004 7:43 am, http-equivexcite.com said:
>> There are lots of little .tmp files generated and accessible
>> remotely to be had, Adobe *.pdf's and a vast array of Microsoft
>> Office 2003 crud to name just two. Many others which have been
>> identified and discussed in the past as well.
EP> I think:
EP> mount /dev/xxxx /tmp -o noexec
EP> would reduce the risk significantly. Can you do something equivalent in
EP> arctic bears - affordable custom email and name services
EP> Full-Disclosure - We believe in it.
EP> Charter: http://lists.netsys.com/full-disclosure-charter.html
Существую лишь я сам, никуда не летя. (Лем)
Full-Disclosure - We believe in it.