Thats a really funny security risk. I dont agree with you, because otherwise every editor, which is able to save HTML Files, is a security problem. So vi, Dreamweaver, emacs are all unsecure? It is your decision, to open a HTML file or not. And (if here are some MS guys) please dont fix this issue, because sometimes, if you havent a professional tool at the moment, the Windows editor can be useful, too. Also, if you need to edit some small Scripts.
Yours, SR -----Ursprüngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Fredrick Diggle Gesendet: Donnerstag, 17. Januar 2008 18:44 An: [email protected] Betreff: [Full-disclosure] [FDSA] Notepad Highly Critical Cross-Site Scripting (XSS) Vulnerability ####################################################################### Fredrick Diggle Security Advisory Application: Notepad Versions: 5.1.2600.2180 verified to be vulnerable Platforms: Microsoft Windows (All Versions) Bugs: Cross Site Scripting (XSS) Severity: Critically High Date: 17 Jan 2008 Credit: Estr Hinan ####################################################################### 1) Introduction 2) Bugs 4) Fix ####################################################################### =============== 1) Introduction =============== Fredrick Diggle Security Services is probably the best application security researchers on the scene this month. They have identified several hundred thousand vulnerabilities this week for which Priv8 0dayz have been developed. Fredrick Diggle Security Team periodically releases several of these vulnerabilities to the community at large (Pre Vendor Release!!!!). Fred Diggle would like to ensure that you understand this is 0DAY!!!. The vendors are completely unaware of this vulnerabilities. ####################################################################### ======= 2) Bug ======= Notepad is a utility which is built into all current versions of Microsoft Windows. Notepad contains a highly exploitable stored cross-site scripting vulnerability when files are saved with the following extensions: htm html Other extensions may also be vulnerable in your environment depending on configuration. When arbitrary javascript code is entered into the notepad text window and saved using one of the vulnerable extensions a payload file is created. When an innocent user opens this payload file cross-site scripting occurs. ####################################################################### ======= 3) Proof of Concept ======= 1. Open Notepad 2. Enter the following text <script>alert("xss");</script> 3. Save file as "exploit.html" 4. double click the payload file ####################################################################### ====== 4) Fix ====== Notepad should be rewritten to filter potentially dangerous characters. Characters can be converted to their html encoded equivalents. ####################################################################### _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
