Skip to site navigation (Press enter)
RE: [Full-Disclosure] MSIE
and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!))</span></a></span> </h1> <p class="darkgray font13"> <span class="sender pipe"><a href="/search?l=full-disclosure@lists.netsys.com&q=from:%22Menashe+Eliezer%22" rel="nofollow"><span itemprop="author" itemscope itemtype="http://schema.org/Person"><span itemprop="name">Menashe Eliezer</span></span></a></span> <span class="date"><a href="/search?l=full-disclosure@lists.netsys.com&q=date:20041107" rel="nofollow">Sun, 07 Nov 2004 15:15:34 -0800</a></span> </p> </div> <div itemprop="articleBody" class="msgBody"> <!--X-Body-of-Message--> <pre>The published exploit is working also with the <EMBED> tag, and not just with the <IFRAME> and the <FRAME> tags. Finjan's advisory can be found at: <a href="http://www.finjan.com/SecurityLab/AttackandExploitReports/alert_show.asp">http://www.finjan.com/SecurityLab/AttackandExploitReports/alert_show.asp</a> ?attack_release_id=114</pre><pre> == Regards, Menashe Eliezer Senior application security architect Malicious Code Research Center Finjan Software <a href="http://www.finjan.com/mcrc">http://www.finjan.com/mcrc</a> Prevention is the best cure! -----Original Message----- From: morning_wood [<a href="mailto:[EMAIL">mailto:[EMAIL</a> PROTECTED] Sent: Tuesday, November 02, 2004 3:44 PM To: Berend-Jan Wever; [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!)) bindshell success ( html run from local ) connect from remote success... this is NASTY if shellcode modified this will do reverse or exe drop i assume.... good work, Donnie Werner ----------------------------------------------- This message was scanned for malicious content and viruses by Finjan Internet Vital Security 1Box(tm) _______________________________________________ Full-Disclosure - We believe in it. Charter: <a href="http://lists.netsys.com/full-disclosure-charter.html">http://lists.netsys.com/full-disclosure-charter.html</a> </pre> </div> <div class="msgButtons margintopdouble"> <ul class="overflow"> <li class="msgButtonItems"><a class="button buttonleft buttondisabled" accesskey="p" href="#">Previous message</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="c" href="thrd15.html#25500">View by thread</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="i" href="mail15.html#25500">View by date</a></li> <li class="msgButtonItems textalignright"><a class="button buttonright " accesskey="n" href="msg25502.html">Next message</a></li> </ul> </div> <a name="tslice"></a> <div class="tSliceList margintopdouble"> <ul class="icons monospace"> <li class="icons-email"><span class="subject"><a href="msg25502.html">Re: [Full-Disclosure] MSIE <IFRAME> and <FR...</a></span> <span class="sender italic">Menashe Eliezer</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25502.html">Re: [Full-Disclosure] MSIE <IFRAME> and &...</a></span> <span class="sender italic">Berend-Jan Wever</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25505.html">Re: [Full-Disclosure] MSIE <IFRAME> a...</a></span> <span class="sender italic">patryn</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25524.html">Re: [Full-Disclosure] MSIE <IFRAME&g...</a></span> <span class="sender italic">Valdis . Kletnieks</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25536.html">Re: [Full-Disclosure] MSIE <IFRA...</a></span> <span class="sender italic">Jim Geovedi</span></li> </ul></li> </ul></li> </ul></li> <li class="icons-email"><span class="subject"><a href="msg25538.html">Re: [Full-Disclosure] MSIE <IFRAME> and &...</a></span> <span class="sender italic">Georgi Guninski</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg25542.html">Re: [Full-Disclosure] MSIE <IFRAME> a...</a></span> <span class="sender italic">pachiderme pachiderme</span></li> </ul> </ul> </ul> </div> <div class="overflow msgActions margintopdouble"> <div class="msgReply" > <h2> Reply via email to </h2> <form method="POST" action="/mailto.php"> <input type="hidden" name="subject" value="RE: [Full-Disclosure] MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!))"> <input type="hidden" name="msgid" value="04F8F5F9BE29F746BC63DBFCA32D011B9A5960@exchange.Finjan.co.il"> <input type="hidden" name="relpath" value="full-disclosure@lists.netsys.com/msg25500.html"> <input type="submit" value=" Menashe Eliezer "> </form> </div> </div> </div> <div class="aside" role="complementary"> <div class="logo"> <a href="/"><img src="/logo.png" width=247 height=88 alt="The Mail Archive"></a> </div> <form class="overflow" action="/search" method="get"> <input type="hidden" name="l" value="full-disclosure@lists.netsys.com"> <label class="hidden" for="q">Search the site</label> <input class="submittext" type="text" id="q" name="q" placeholder="Search full-disclosure"> <input class="submitbutton" name="submit" type="image" src="/submit.png" alt="Submit"> </form> <div class="nav margintop" id="nav" role="navigation"> <ul class="icons font16"> <li class="icons-home"><a href="/">The Mail Archive home</a></li> <li class="icons-list"><a href="/full-disclosure@lists.netsys.com/">full-disclosure - all messages</a></li> <li class="icons-about"><a href="/full-disclosure@lists.netsys.com/info.html">full-disclosure - about the list</a></li> <li class="icons-expand"><a href="/search?l=full-disclosure@lists.netsys.com&q=subject:%22RE%5C%3A+%5C%5BFull%5C-Disclosure%5C%5D+MSIE+%3CIFRAME%3E+and+%3CFRAME%3E+tag+NAME+property+bufferoverflow+PoC+exploit+%5C%28was%5C%3A+python+does+mangleme+%5C%28with+IE+bugs%5C%21%5C%29%5C%29%22&o=newest&f=1" title="e" id="e">Expand</a></li> <li class="icons-prev"><a href="#" title="p">Previous message</a></li> <li class="icons-next"><a href="msg25502.html" title="n">Next message</a></li> </ul> </div> <div class="listlogo margintopdouble"> </div> <div class="margintopdouble"> </div> </div> </div> <div class="footer" role="contentinfo"> <ul> <li><a href="/">The Mail Archive home</a></li> <li><a href="/faq.html#newlist">Add your mailing list</a></li> <li><a href="/faq.html">FAQ</a></li> <li><a href="/faq.html#support">Support</a></li> <li><a href="/faq.html#privacy">Privacy</a></li> <li class="darkgray">04F8F5F9BE29F746BC63DBFCA32D011B9A5960@exchange.Finjan.co.il</li> </ul> </div> </body> </html> <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9d68a71ec8ddf8ab',t:'MTc3MjU0MTAzMA=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script>