Delivered-To: [EMAIL PROTECTED] Date: Fri, 30 Jan 2004 14:46:43 -0600 From: Mike Skallas <[EMAIL PROTECTED]> Subject: Re: [IP] more on (seems it is not just IE -- ) MSFT: don't click on links, type them in by hand To: [EMAIL PROTECTED]
>this vulnerability is also present in Mozilla, so Mr. Link's solution >fails on its merits.
This is simply untrue. You can test the vulnerability here:
http://www.secunia.com/internet_explorer_address_bar_spoofing_test
On firebird .7 the URL box reads:
http://[EMAIL PROTECTED]/internet_explorer_address_bar_spoofing_test/
On Mozilla 1.5 it reads:
http://[EMAIL PROTECTED]/internet_explorer_address_bar_spoofing_test/
On IE 6 it reads:
http://www.microsoft.com
Mike http://everythingisnt.com
and
From: Steven Champeon <[EMAIL PROTECTED]> Subject: Re: [IP] more on (seems it is not just IE -- ) MSFT: don't click on links, type them in by hand X-Originating-IP: [127.0.0.1] To: Dave Farber <[EMAIL PROTECTED]> Cc: [EMAIL PROTECTED]
on Fri, Jan 30, 2004 at 03:36:08PM -0500, Dave Farber wrote: > Delivered-To: [EMAIL PROTECTED] > Date: Fri, 30 Jan 2004 14:13:34 -0500 (EST) > From: Bruce Campbell <[EMAIL PROTECTED]> > Subject: Re: [IP] [Boing Boing Blog] MSFT: don't click on links, > type them in by hand > To: [EMAIL PROTECTED]
<snip>
> I'd be interested in knowing what browsers/mail readers fail the test.
Safari 1.1.1 (Panther) passes with flying colors, FWIW - the entire URL, %00 and all, is displayed in the status bar (if shown). But the link still takes you to clicknation.com.
If the status bar is hidden, which is possible by way of a window.open() Javascript call with the right parameters - which can be launched by an unwitting user clicking on a link with an onclick event handler defined - then all bets are off.
Steve
-- hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com Book publishing is second only to furniture delivery in slowness. -b. schneier
------------------------------------- You are subscribed as [EMAIL PROTECTED] To manage your subscription, go to http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/
