Bugtraq mailing list archives
Re: Re: Re: Re: Re: Opera 9.6x file:// overflow
From: theindigowolf () gmail com
Date: Thu, 20 Nov 2008 16:30:15 +0000
Does that also hold true if you use a javascript/java applet to deliver the URL rather than just placing it in a text link? ------Original Message------ From: psy.echo () gmail com Sender: To: bugtraq () securityfocus com Subject: Re: Re: Re: Re: Re: Opera 9.6x file:// overflow Sent: Nov 19, 2008 5:59 PM Hi Peter, Apropos File URI scheme, if you are saying about accessing a file with something like file://abcd... in a link, 'over a network', then most of the browsers (perhaps all) do not follow "file:" links on a page that is fetched with "HTTP". The purpose is "security" or to prevent a remote page from executing a program on the visitor's computer. The file: links work on pages that are local files on the user's disk! Though in some browsers these settings can be changed. That is why the Opera exploit through file://abcd.... does not work on network. Hope it answers your query! -- Thanks & Regards, Rishi Narang | Security Researcher Member, Evil Fingers Vulnerability Research Analyst, Third Brigade Labs Blog: www.greyhat.in | Associations: www.evilfingers.com | www.thirdbrigade.com .... eschew obfuscation, espouse elucidation. Sent via BlackBerry by AT&T
Current thread:
- Opera 9.6x file:// overflow send9 (Nov 17)
- <Possible follow-ups>
- Re: Opera 9.6x file:// overflow jplopezy (Nov 18)
- Re: Re: Opera 9.6x file:// overflow jplopezy (Nov 18)
- Re: Re: Re: Opera 9.6x file:// overflow send9 (Nov 18)
- Re: Opera 9.6x file:// overflow xiashing (Nov 19)
- Re: Re: Re: Re: Opera 9.6x file:// overflow peterjohan () ukr net (Nov 19)
- Re: Re: Re: Re: Opera 9.6x file:// overflow Zack Payton (Nov 19)
- Re: Re: Re: Re: Re: Opera 9.6x file:// overflow psy . echo (Nov 20)
- Re: Re: Re: Re: Re: Opera 9.6x file:// overflow theindigowolf (Nov 20)
- Re: Re: Re: Re: Re: Re: Opera 9.6x file:// overflow send9 (Nov 20)