Vulnerability Development: RE: Odd MSIE html parsing

From: Golden_Eternity <bhodi_jabir_at_yahoo.com>
Date: Wed, 2 Jan 2002 10:45:22 -0800

Wasn't able to reproduce this with patched IE6 on 2k.

> -----Original Message-----
> From: Matthew S. Hallacy [mailto:poptix_at_techmonkeys.org]
> Sent: Wednesday, January 02, 2002 5:36 AM
> To: vuln-dev_at_securityfocus.com
> Subject: Odd MSIE html parsing
>
>
> I recieved an odd spam today, the links were obfuscated as follows:
>
> <A
> HREF="http://www.ca1.waredet.net.co.fr^T^B^T^E^T|https.travel.bzah.com^B">
>
> clicking on the link in MSIE shows the following in the address bar:
> 'http://www.ca1.waredet.net.co.fr(?????)|https.travel.bzah.com/'
> while it's really going to https.travel.bzah.com (a stupid
> angelfire spam site,
> die die die)
>
> Comments? I'm curious as to why MSIE allows control characters in the url
> like this, it didn't work in Mozilla.
>
> - Matthew S. Hallacy
> --
>
Received on Jan 03 2002