|
Brought to you by:
Suppliers of:
|
|
|
| |
| Some HTML browsers can be tricked, using HTML forms, into sending arbitrary data to any TCP port. This can be used to send commands to servers using ASCII based protocols like SMTP, NNTP, POP3, IMAP, IRC, and probably others. By sending HTML email to unsuspecting users or using a special HTML page, an attacker might be able to send mail or post Usenet News through servers normally not accessible to him. In special cases, an attacker might be able to do other harm, e.g. deleting mail from a POP3 mailbox. |
| |
Credit:
The information has been provided by Jochen Topf, Bennett Samowich, and Barnaby Gray, .
|
| |
Vulnerable systems:
Netscape version 4.77 (Linux) allows access to non-privileged ports, but restricts access to privileged ports. This can be bypassed by issuing port number above 65535 (accessing port 65535+21 = 65556, will cause it to access port 21 instead of 65556)
Netscape version 6.0/6.01
Netscape version 6.1 - only allows access to non-privileged ports
Opera version 5 (Linux)
Internet Explorer version 5.50.4522.1800
Lynx (Linux)
Mozilla version 0.9.1
The full explanation of this exploit can be found at:
http://www.remote.org/jochen/sec/hfpa/index.html
|
|
|
|
|
