Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos network security services platform







Bugtraq: IE: double slash moves cache from INTERNET zone to MYCOMPUTER zone

IE: double slash moves cache from INTERNET zone to MYCOMPUTER zone

From: Liu Die Yu <liudieyuinchina_at_yahoo.com.cn>
Date: 5 Nov 2003 10:31:53 -0000
('binary' encoding is not supported, stored as-is) double slash moves cache from INTERNET zone to MYCOMPUTER zone
("that's all" is the end of file if you are in a hurry)

[tested]
OS:WinXp
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/10/30

[technical detail]
copy an EXE file to your cache directory:
[SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
then try to use CODEBASE trick to execute that file (refer to http://continue.to/trie --> "codebase local path"), you'll get an error message.
however set CODEBASE to:
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
(double slash after [SysDrive])
EXE.EXE in cache directory will be executed.

conclusion:
[SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
is treated in INTERNET zone.
but
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
is treated in MYCOMPUTER zone.

that's all.

of course, it's added to "Unpatched IE Bugs" list maintained by me. here: http://continue.to/trie



[greeting]
greetings to:
the Pull, dror, guninski and mkill.

-----
all mentioned resources can always be found at UMBRELLA.MX.TC

[contact]
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"
Received on Nov 05 2003
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]