Re: [sb] RE: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

[BoneMachine <bonemach () sdf lonestar org>]

Hi Jelmer, 
I've read your analysis of the trojan of 180  solutions and noticed the statement that this issue uses two zero day 
exploits.
I'm trying to monitor and register IE vulnerabilities and have a strong feeling I've seen the Location header execution 
before. 
Just to be sure, are you aware that:
- Liu Die Yu discards the local protocol issue as a refresh issue:
http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage.htm
- Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the vulnerabilities uses the following 
statement in the example code :
target.location="ms-its:\\ntshared.chm::/copyright.htm";
The posting to bugtraq can be found at : http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html

To me these issues and your URL: issue seem the same and afaik no patches for these issues had been provided. 

Can you proof me wrong?

vriendelijke groet
Bone Machine

---
"hip hip hip" - The Pixies

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html