Bugtraq mailing list archives
Re: ipb Css bug(now public)
From: Nicolas Gregoire <ngregoire () exaprobe com>
Date: Mon, 08 Aug 2005 21:04:17 +0200
Le lundi 08 août 2005 à 13:12 +0000, mattmecham () gmail com a écrit :
While IPB < 1.3 *might* have been vulnerable, IPB 2.x definitely isn't as HTML files are saved with the mime-type "unknown/unknown" which prompts the user to download the file to their desktop making it totally safe.
<not tested> That may be not true for users using (at least) Internet Explorer, as "MIME-type sniffing" will be used to determine the file type (and handler) to use when opening the file. </not tested> That's what happen in some Oracle web pages sent with "text/plain" and vulnerable to a text/code/JS injection. Oracle isn't to blame (really ?) but the browser (if IE) will execute the JavaScript code. Regards, -- Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information ngregoire () exaprobe com ------[ ExaProbe ]------ http://www.exaprobe.com/ PGP KeyID:CA61B44F FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B44F
Current thread:
- ipb Css bug(now public) virusishacker (Aug 05)
- <Possible follow-ups>
- Re: ipb Css bug(now public) mattmecham (Aug 08)
- Re: ipb Css bug(now public) Nicolas Gregoire (Aug 08)