Well said. This class of attack has been known for a long time - got public in 2004 as Paul's links indicated. Since then it's widely understood and heavily assessed ... mms: mailto: HCP: notes: etc. Thor's finding is a surprise - years passed and an extremely simple vector of attack still works in IE.
On 7/10/07, Paul Szabo <[EMAIL PROTECTED]> wrote: > Thor Larholm wrote: > > > There is a URL protocol handler command injection vulnerability ... > > http://larholm.com/2007/07/10/internet-explorer-0day-exploit/ > > I wonder whether this is essentially different from: > > Microsoft Internet Explorer 6 Protocol Handler Vulnerability > http://www.securityfocus.com/archive/1/370959 > http://www.securityfocus.com/archive/1/371061 > http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/024833.html > > Please enlighten. > > Thanks, > > Paul Szabo [EMAIL PROTECTED] http://www.maths.usyd.edu.au/u/psz/ > School of Mathematics and Statistics University of Sydney Australia > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
