Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: shell:windows command question
From: Barry Fitzgerald <bkfsec () sdf lonestar org>
Date: Thu, 08 Jul 2004 09:29:31 -0400

Andreas Sandblad wrote:

Did some quick search on Bugzilla and came up with the following:

Mozilla allows external protocols as discussed in:
http://bugzilla.mozilla.org/show_bug.cgi?id=167475
They seem to blacklist the following external protocol handlers:
(patch http://bugzilla.mozilla.org/attachment.cgi?id=102263&action=view)
hcp, vbscript, javascript, ms-help, vnd.ms.radio

A simple solution would be to add the shell protocol to this list.
Personally I think a secure blacklist is hard to maintain as new
dangerous external protocols could be invented by third-parties leaving
Mozilla vulnerable again.


Completely agreed.

There should be a whitelist, not a blacklist... a safe protocols list.

            -Barry


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault