Re: [Full-Disclosure] RE: FWD: Internet Explorer URL parsing vulnerability

[Georgi Guninski <guninski@guninski.com>]

On Wed, 10 Dec 2003 16:06:20 +0100
Rainer Gerhards <rgerhards@hq.adiscon.com> wrote:

> Just to add
> 
> http://www.microsoft.com:security%00@www.linux.org/
> 
> works equally well with Mozilla/5.0 (X11; U; Linux i686; en-US;
> rv:1.2.1) Gecko/20030225 under Red Hat Linux 9. So it is not just an IE
> issue...
> 

On mozilla 1.5 the above does not work.
The location bar displays
http://www.microsoft.com:security%00@www.linux.org/
which seems the expected behavior.


On linux more fun seems this:

http://www.microsoft.com__________________________________________________________________@www.fuckmicrosoft.com/

georgi





_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html