Vulnerability Development mailing list archives

Re: netscape 4.61 recognizes file.changed-doc/xls


From: morrisok () EXECULINK COM (Nathan Einwechter)
Date: Sun, 28 May 2000 22:18:11 -0400


I don't know if this has already been explored, but if word and excel files are correctly recognised without the 
extensions, how does Word and Excel do this? 

If this where to be discovered I cannot see a reason why one wouldn't be able to trick the programs into believing it 
is a Word or Excel file, which would, in turn, could possibly open various other holes, I don't really know much about 
what could be done through word or excel, but I can see some possiblities with this.

Anyways, just a brain wave which I decided to write out.

-- Nathan Einwechter
   Non-Existant Security

:
:Are you sure that the problem is in Netscape mail? I ask because if you are
:running office on top of NT, word and excel files are correctly recognised
:even if they have no extensions.
:
:Gareth
:


Current thread: