Mele20
Premium
join:2001-06-05
Hilo, HI
1 edit | reply to NICK ADSL UK
Re: Microsoft Security Advisory (935423) Vulnerability in Window
Exploit code here:
»seclists.org/fulldisclosure/2007···563.html
Doesn't work if DEP is on for Explorer.
POC is here:
»seclists.org/fulldisclosure/2007···569.html
When I go to that POC on IE6 on XP Pro SP2, IE immediately crashes.
When go on Fx 1.5.0.11, I get this WHEN USING THE PROXOMITRON WITH SIDKI'S FILTERS:
Microsoft Windows .ANI 0DAY Exploit
Copyright (c) 2007 devcode
• JS Alert: Boo
If I go to to the POC on Fx, WITH PROXO DISABLED, Fx appears to be vulnerable! Or am I misinterpreting this? I do not use an extension to turn off scripting in Fx because I feel the Proxomitron will protect in that area as it has done in this instance.
EDIT: I tried the POC again on Fx with Proxo enabled and now I am getting the same thing I have shown in the screenshot. Orginally, with Proxo running, I only got a plain text alert in the upper left corner of the screen about the javascript. Now I am seeing the popup with Boo in it. I'm not sure what this signifies in regards to Fx vulnerability. Maybe nothing because Fx doesn't crash at POC like IE does? Maybe I need to close and reopen Fx to get an accurate test? I have too many tabs open to do that!
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
