Re: Retests

[Thor Larholm <thor () polypath com>]

Dave Aitel wrote:

> Ah, and I notice that Outlook is vulnerable to the VML bug. How cool is
> that?
>  
It's cool and fun, but really - any application that uses MSHTML to 
parse HTML is by nature vulnerable to this. MSHTML will import and use 
vgx.dll anytime it encounters a DHTML Behavior in the HTML referencing 
#default#VML, which can be done through pure CSS without even declaring 
an XML namespace on the HTML tag and even without using custom tags. As 
with any HTML attack vector, you'll be hard pressed to generate 
IDS/snort signatures to detect this at a perimeter, as the HTML itself 
can be encoded in 1001+ ways through Javascript.


Regards
Thor Larholm
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave