Re: Cross Site Scripting exploitation via malformed files
<!--
On many webmail systems, when the JPG file is downloaded,
then the script is executed (you can play with javascript, vbscript,...)
It was verified under IE - XP SP2
-->
This doesn't seem to be correct [or even work for that matter].
1. As an attachment in the email and received in yahoo or hotmail,
generally most others, it arrives as that, an attachment [Content-
Disposition: attachment; even if inline it would fail as below], which you
then click for download and opening. IE6 XP SP2 there is a download
warning [as there probably is pre-SP2], which if you accept and open the
file, opens with the defeault graphic viewer on XP Windows Picture and Fax
Viewer. Even creating the file locally and opening it with IE directly
generates an empty image container.
2. Pre SP2 and even XP, IE would render the html or code intentionally
placed in basically any file type sitting on a remote server. But that is
old and quite well known should certainly be fixed by now.
Unless of course if something new has cropped up. Has it?
--
http://www.malware.com