RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous

["White, Dain P" <dainw@xxxxxxx>]

Hmmm...

Unfortunately, I have IE7 here, and while I have a standalone IE6, it
lacks the "fundamental interconnectedness" to test if this will work -
if anyone has original IE6, does following this procedure mitigate the
POC?

Open Windows Explorer 
	Tools --> Options --> FileTypes 
	Select PDF, Click Advanced 
	check "Confirm after Download"

Thanks in advance!
~Dain

-----Original Message-----
From: Mark Andrews [mailto:mark_andrews@xxxxxxxxxxxx] 
Sent: Thursday, January 04, 2007 3:00 PM
To: White, Dain P; websecurity@xxxxxxxxxxxxx
Subject: RE: [WEB SECURITY] Universal XSS with PDF files: highly
dangerous

I think you can only disable it.
Internet Options > Manage add-ons > disable Adobe PDF Reader link helper

-ma 

-----Original Message-----
From: White, Dain P [mailto:dainw@xxxxxxx]
Sent: Thursday, January 04, 2007 2:08 PM
To: websecurity@xxxxxxxxxxxxx
Subject: RE: [WEB SECURITY] Universal XSS with PDF files: highly
dangerous

There's some very incredible work being done here, some of the
javascript masters on this list downright scare the bejabbers outta me.
I can actually hear the sky falling, thanks! :|

Does anyone have any advice on a workaround for IE6 that approximates
the firefox / opera workaround of defaulting to save the pdf file rather
than open? If I missed the tip in the deluge of messages, I apologize in
advance...

~Dain

------------------------------------------------------------------------
----
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]


----------------------------------------------------------------------------
The Web Security Mailing List:
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]