Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
[Full-disclosure] Re: Microsoft Internet Explorer Content-Disposition HTML File Handling Flaw
From: Darren Bounds (dboundsgmail.com)
Date: Tue Apr 11 2006 - 14:35:38 CDT
Please be advised my testing occured on Windows XP SP2 and Windows
2003 SP1, both with the latest versions of IE 6 and IE 7 Beta 2.
I'm hearing from various people that some versions of IE on Windows
2000 do not appear to be affected. There may be others as well.
On 4/10/06, Darren Bounds <dboundsgmail.com> wrote:
> Microsoft Internet Explorer Content-Disposition HTML File Handling Flaw
> April 10, 2006
> Content-Disposition (defined in RFC 2183) is often used by web
> application developers as a mechanism to instruct the web browser on
> how it should handle a file download. This is commonly used to help
> prevent access to the application scope when handling file attachments
> and mitigates the ability to leverage client-side attacks, such as
> XSS, through file downloads.
> While Internet Explorer does handle downloading most file types
> correctly with Content-Disposition, it mishandles HTML files and
> instead opens them inline, exposing the application scope. As such, it
> is strongly advisable that web-based software vendors use alternative
> methods to mitigate this class of attack.
> A simple PoC is available at the following URL:
> Feel free to compare the results of Firefox and IE.
> Vulnerable Versions:
> All versions up to and including Internet Explorer 7 Beta 2.
> I felt it was necessary to make this flaw public now because while the
> weakness results from IEs flawed support of RFC 2183, the exposure is
> with the 3rd party applications which support it.
> Due to the simplicity of exploitation, it is not unlikely this is
> being used in the wild.
> Thank you,
> Darren Bounds
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/