[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Invalid ContentType may disclose cache directory
From: Liu Die Yu <liudieyuinchina () yahoo ! com ! cn>
Date: 2003-11-25 10:02:42
[Download RAW message or body]
Invalid ContentType may disclose cache directory
[tested]
OS:WinXp, CN version
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16
[overview]
The problem lies in the download function of Internet Explorer. This can be exploited \
by malicious web pages to get cache directory including random names.
[demo]
There are two harmless demos:
1st, online demo, powered by ASP:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo
2nd, demo in ZIP format, powered by NETCAT:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo.zip
[technical details]
When CONTENTTYPE in HTTP response is invalid and file extension is "HTM", the \
downloaded HTM file will be opened in cache directory, in INTERNET security zone.
In the 1st demo, this is done by the following ASP code:
----------
response.ContentType = "whocares"
response.AddHeader "content-disposition", "inline; filename=test.htm"
----------
In the 2nd demo, this is done with the help of NETCAT.
[Workaround]
Disable Active Scripting in INTERNET zone, so HTML page opened in the cache can't \
send information back to the attacker.
[Greetings]
greetings to:
Drew Copley, dror, guninski and mkill.
-----
all mentioned resources can always be found at UMBRELLA.MX.TC
[people]
LiuDieyuinchina [N0-@-Sp2m] yahoo.com.cn
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"
[Employment]
I would like to work professionally as a security researcher/bug finder.
See my resume at my site. I am very eager to work, flexible, and
extremely productive. I have a top notch resume, with credentials
from leading bug finders. I am willing to work per contract, relocate,
or telecommute.
[Give a Hand]
I haven't got a job as a security researcher yet and my family don't support my \
security work - so, I don't have a computer of my own. Please consider about donating \
at: http://clik.to/donatepc
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic