Home page logo

bugtraq logo Bugtraq mailing list archives

Microsoft has just fixed hotmail/css hole
From: gregory duchemin <c3rb3r () HOTMAIL COM>
Date: Tue, 30 Jan 2001 22:57:30 -0000

Microsoft has finally patched today the css/div hole in hotmail.
Absolute positionning in 'style' is now filtered with static.
Others web based mailers, sites with bookmark, forum etc ... should quickly
do the same.
Above, the original mail from wouter Westerveld who informed me.

Gregory Duchemin


 Hotmail has fixed the "css hotmail spoofing/ password recovery" bug. I
 was just testing it, and at once, it didn't work anymore.

 Hotmail will replace "positon: absolue" by "position: static".  Here
 below, there is a part of te source from what I sended to hotmail, and
 of what hotmail made from it.

 I don't know if I've to send this email to BugTraq, so please forward it
 for me if you think that is nessecery.


 Wouter Westerveld
    (16 jr, the Netherlands)

 --------This is what i sended to Hotmail:----------------

 <div align="left">
   <div id="layer1" style="width:101%; height:950; position:absolute;
 left:0px; top:0px; z-index:0;">

         <div id="layer2" style="position:absolute; left:40; top:10;

 -------This stood in the source of the Hotmail HTML-Page--------------
   <div id="layer1" style="width:101%; height:950; position:static;
 left:0px; top:0px; z-index:0;

         <div id="layer2" style="position:static; left:40; top:10;

 <form name="passwordform2" action="";
 method="GET" target="_blank" AUTOCOMPLETE="OFF" >
 <input type=hidden name="hm___action"

 <table cellpadding=0 cellspacing=0 border=0 widthY0>
   <td colspan=2>

Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

  By Date           By Thread  

Current thread:
  • Microsoft has just fixed hotmail/css hole gregory duchemin (Jan 31)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]