[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
- From: pst <pst@xxxxxxxx>
- Subject: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
- Date: Mon, 8 Jan 2007 08:43:50 +0100
------=_Part_40384_5852340.1168242230138
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64
Content-Disposition: inline
SGkgYWxsCgpGb3IgRmlyZWZveCBpdCBhbHNvIGRlcGVuZHMgb24gdGhlIHBsYXRmb3JtLiBGb3Ig
aW5zdGFuY2Ugb24gR05VL0xpbnV4IHRoZXJlCmlzIG5vIEFkb2JlIEFjcm9iYXQgUmVhZGVyIDgg
dmVyc2lvbiBhdmFpbGFibGUgYW4gaGVyZSBvbiBteSBib3ggd2l0aApVYnVudHUsIEZpcmVmb3gg
Mi4wLjAuMSBhbmQgQWNyb2JhdCA3LjAuOCB0aGUgdnVsbmVyYWJpbGl0eSBkb2Vzbid0IHdvcmsg
IQoKCk9uIDEvNC8wNywgQmlsbHkgSG9mZm1hbiA8QmlsbHkuSG9mZm1hbkBzcGlkeW5hbWljcy5j
b20+IHdyb3RlOgo+Cj4gIFN5bWFudGljIHVwZGF0ZWQgd2hhdCBicm93c2VyL3JlYWRlciB2ZXJz
aW9ucyBhcmUgYWZmZWN0ZWQgYnkgdGhpcy4KPiBJbml0aWFsIHJlcG9ydHMgbWFkZSBtZSB0aGlu
ayB0aGlzIHdhcyBuYXN0eSwgYnV0IG5vdCB0b28gYmFkIGJlY2F1c2UgaXQKPiBkb2Vzbid0IGFm
ZmVjdCBTUDIuIEFwcGFyZW50bHkgdGhhdCdzIG5vdCB0cnVlIGFueW1vcmUuCj4KPgo+Cj4KPiBo
dHRwOi8vd3d3LnN5bWFudGVjLmNvbS9lbnRlcnByaXNlL3NlY3VyaXR5X3Jlc3BvbnNlL3dlYmxv
Zy8yMDA3LzAxL3doZW5fcGRmc19hdHRhY2suaHRtbAo+Cj4KPgo+Cj4KPiBJRTYgKyBBY3JvYmF0
IFJlYWRlciA3ICsgWFAgU1AxCj4gSUU2ICsgQWNyb2JhdCBSZWFkZXIgNCArIFhQIFNQMgo+IEZp
cmVmb3ggMi4wLjAuMQo+IEZpcmVmb3ggMS41LjAuOAo+IE9wZXJhIDguNS40IGJ1aWxkIDc3MAo+
IE9wZXJhIDkuMTAuODY3OQo+Cj4KPgo+IEkndmUgaGVhcmQgSUU2IG9uIG90aGVyIHBsYXRmb3Jt
cyBpcyB2dWxuIHRvbywgYnV0IGhhdmVuJ3QgY29uZmlybWVkIHRoYXQKPiBvciB0aGUgcmVhZGVy
IHZlcnNpb25zIGZvciB0aGF0IHZlY3Rvci4KPgo+Cj4KPiBCaWxseSBIb2ZmbWFuCj4KPiAtLQo+
Cj4gTGVhZCBSZXNlYXJjaGVyLCBTUEkgTGFicwo+Cj4gU1BJIER5bmFtaWNzIEluYy4g4oCTIGh0
dHA6Ly93d3cuc3BpZHluYW1pY3MuY29tCj4KPiBQaG9uZTogIDY3OC03ODEtNDgwMAo+Cj4gRGly
ZWN0OiAgIDY3OC03ODEtNDg0NQo+Cj4KPgpjaWFvLApwc3QK
------=_Part_40384_5852340.1168242230138
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
Content-Disposition: inline
SGkgYWxsPGJyPjxicj5Gb3IgRmlyZWZveCBpdCBhbHNvIGRlcGVuZHMgb24gdGhlIHBsYXRmb3Jt
LiBGb3IgaW5zdGFuY2Ugb24gR05VL0xpbnV4IHRoZXJlIGlzIG5vIEFkb2JlIEFjcm9iYXQgUmVh
ZGVyIDggdmVyc2lvbiBhdmFpbGFibGUgYW4gaGVyZSBvbiBteSBib3ggd2l0aCBVYnVudHUsIEZp
cmVmb3ggPGEgaHJlZj0iaHR0cDovLzIuMC4wLjEiPjIuMC4wLjE8L2E+IGFuZCBBY3JvYmF0IAo3
LjAuOCB0aGUgdnVsbmVyYWJpbGl0eSA8c3BhbiBzdHlsZT0iZm9udC1zdHlsZTogaXRhbGljOyI+
ZG9lc24mIzM5O3Qgd29yazwvc3Bhbj4gITxicj48YnI+PGJyPjxkaXY+PHNwYW4gY2xhc3M9Imdt
YWlsX3F1b3RlIj5PbiAxLzQvMDcsIDxiIGNsYXNzPSJnbWFpbF9zZW5kZXJuYW1lIj5CaWxseSBI
b2ZmbWFuPC9iPiAmbHQ7PGEgaHJlZj0ibWFpbHRvOkJpbGx5LkhvZmZtYW5Ac3BpZHluYW1pY3Mu
Y29tIj4KQmlsbHkuSG9mZm1hbkBzcGlkeW5hbWljcy5jb208L2E+Jmd0OyB3cm90ZTo8L3NwYW4+
PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0iYm9yZGVyLWxlZnQ6IDFweCBz
b2xpZCByZ2IoMjA0LCAyMDQsIDIwNCk7IG1hcmdpbjogMHB0IDBwdCAwcHQgMC44ZXg7IHBhZGRp
bmctbGVmdDogMWV4OyI+CgoKCgoKCgoKCgo8ZGl2IGxpbms9ImJsdWUiIHZsaW5rPSJibHVlIiBs
YW5nPSJFTi1VUyI+Cgo8ZGl2PgoKPHA+PGZvbnQgY29sb3I9Im5hdnkiIGZhY2U9IkFyaWFsIiBz
aXplPSIyIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMHB0OyBmb250LWZhbWlseTogQXJpYWw7
IGNvbG9yOiBuYXZ5OyI+U3ltYW50aWMgdXBkYXRlZCB3aGF0IGJyb3dzZXIvcmVhZGVyIHZlcnNp
b25zCmFyZSBhZmZlY3RlZCBieSB0aGlzLiBJbml0aWFsIHJlcG9ydHMgbWFkZSBtZSB0aGluayB0
aGlzIHdhcyBuYXN0eSwgYnV0IG5vdCB0b28KYmFkIGJlY2F1c2UgaXQgZG9lc24ndCBhZmZlY3Qg
U1AyLiBBcHBhcmVudGx5IHRoYXQncyBub3QgdHJ1ZQphbnltb3JlLjwvc3Bhbj48L2ZvbnQ+PC9w
PgoKPHA+PGZvbnQgY29sb3I9Im5hdnkiIGZhY2U9IkFyaWFsIiBzaXplPSIyIj48c3BhbiBzdHls
ZT0iZm9udC1zaXplOiAxMHB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiBuYXZ5OyI+Jm5i
c3A7PC9zcGFuPjwvZm9udD48L3A+Cgo8cD48Zm9udCBjb2xvcj0ibmF2eSIgZmFjZT0iQXJpYWwi
IHNpemU9IjIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiBBcmlh
bDsgY29sb3I6IG5hdnk7Ij48YSBocmVmPSJodHRwOi8vd3d3LnN5bWFudGVjLmNvbS9lbnRlcnBy
aXNlL3NlY3VyaXR5X3Jlc3BvbnNlL3dlYmxvZy8yMDA3LzAxL3doZW5fcGRmc19hdHRhY2suaHRt
bCIgdGFyZ2V0PSJfYmxhbmsiIG9uY2xpY2s9InJldHVybiB0b3AuanMuT3BlbkV4dExpbmsod2lu
ZG93LGV2ZW50LHRoaXMpIj4KaHR0cDovL3d3dy5zeW1hbnRlYy5jb20vZW50ZXJwcmlzZS9zZWN1
cml0eV9yZXNwb25zZS93ZWJsb2cvMjAwNy8wMS93aGVuX3BkZnNfYXR0YWNrLmh0bWw8L2E+PC9z
cGFuPjwvZm9udD48L3A+Cgo8cD48Zm9udCBjb2xvcj0ibmF2eSIgZmFjZT0iQXJpYWwiIHNpemU9
IjIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiBBcmlhbDsgY29s
b3I6IG5hdnk7Ij4mbmJzcDs8L3NwYW4+PC9mb250PjwvcD4KCjxwPjxmb250IGNvbG9yPSJuYXZ5
IiBmYWNlPSJBcmlhbCIgc2l6ZT0iMiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTBwdDsgZm9u
dC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogbmF2eTsiPiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9wPgoK
PHA+PGZvbnQgY29sb3I9Im5hdnkiIGZhY2U9IkFyaWFsIiBzaXplPSIyIj48c3BhbiBzdHlsZT0i
Zm9udC1zaXplOiAxMHB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiBuYXZ5OyI+SUU2ICsg
QWNyb2JhdCBSZWFkZXIgNyArIFhQIFNQMTxicj4KSUU2ICsgQWNyb2JhdCBSZWFkZXIgNCArIFhQ
IFNQMjxzcGFuIGNsYXNzPSJxIj48YnI+CkZpcmVmb3ggPGEgaHJlZj0iaHR0cDovLzIuMC4wLjEi
IHRhcmdldD0iX2JsYW5rIiBvbmNsaWNrPSJyZXR1cm4gdG9wLmpzLk9wZW5FeHRMaW5rKHdpbmRv
dyxldmVudCx0aGlzKSI+Mi4wLjAuMTwvYT48YnI+PC9zcGFuPjxzcGFuIGNsYXNzPSJxIj4KRmly
ZWZveCA8YSBocmVmPSJodHRwOi8vMS41LjAuOCIgdGFyZ2V0PSJfYmxhbmsiIG9uY2xpY2s9InJl
dHVybiB0b3AuanMuT3BlbkV4dExpbmsod2luZG93LGV2ZW50LHRoaXMpIj4xLjUuMC44PC9hPjxi
cj48L3NwYW4+PHNwYW4gY2xhc3M9InEiPgpPcGVyYSA4LjUuNCBidWlsZCA3NzA8YnI+PC9zcGFu
PgpPcGVyYSA5LjEwLjg2Nzk8L3NwYW4+PC9mb250PjwvcD4KCjxwPjxmb250IGNvbG9yPSJuYXZ5
IiBmYWNlPSJBcmlhbCIgc2l6ZT0iMiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTBwdDsgZm9u
dC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogbmF2eTsiPiZuYnNwOzwvc3Bhbj48L2ZvbnQ+PC9wPgoK
PHA+PGZvbnQgY29sb3I9Im5hdnkiIGZhY2U9IkFyaWFsIiBzaXplPSIyIj48c3BhbiBzdHlsZT0i
Zm9udC1zaXplOiAxMHB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiBuYXZ5OyI+SSd2ZSBo
ZWFyZCBJRTYgb24gb3RoZXIgcGxhdGZvcm1zIGlzCnZ1bG4gdG9vLCBidXQgaGF2ZW4ndCBjb25m
aXJtZWQgdGhhdCBvciB0aGUgcmVhZGVyIHZlcnNpb25zIGZvciB0aGF0CnZlY3Rvci48L3NwYW4+
PC9mb250PjwvcD48c3BhbiBjbGFzcz0icSI+Cgo8cD48Zm9udCBjb2xvcj0ibmF2eSIgZmFjZT0i
QXJpYWwiIHNpemU9IjIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5
OiBBcmlhbDsgY29sb3I6IG5hdnk7Ij4mbmJzcDs8L3NwYW4+PC9mb250PjwvcD4KCjxwPjxmb250
IGNvbG9yPSJuYXZ5IiBmYWNlPSJBcmlhbCIgc2l6ZT0iMiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6
ZTogMTBwdDsgZm9udC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogbmF2eTsiPkJpbGx5IEhvZmZtYW48
L3NwYW4+PC9mb250PjwvcD4KCjxwPjxmb250IGNvbG9yPSJuYXZ5IiBmYWNlPSJBcmlhbCIgc2l6
ZT0iMiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTBwdDsgZm9udC1mYW1pbHk6IEFyaWFsOyBj
b2xvcjogbmF2eTsiPi0tPC9zcGFuPjwvZm9udD48L3A+Cgo8cD48Zm9udCBjb2xvcj0ibmF2eSIg
ZmFjZT0iQXJpYWwiIHNpemU9IjIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQt
ZmFtaWx5OiBBcmlhbDsgY29sb3I6IG5hdnk7Ij5MZWFkIFJlc2VhcmNoZXIsIFNQSQogTGFiczwv
c3Bhbj48L2ZvbnQ+PC9wPgoKPHA+PGZvbnQgY29sb3I9Im5hdnkiIGZhY2U9IkFyaWFsIiBzaXpl
PSIyIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMHB0OyBmb250LWZhbWlseTogQXJpYWw7IGNv
bG9yOiBuYXZ5OyI+U1BJCiBEeW5hbWljczwvc3Bhbj48L2ZvbnQ+PGZvbnQgY29sb3I9Im5hdnki
IGZhY2U9IkFyaWFsIiBzaXplPSIyIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMHB0OyBmb250
LWZhbWlseTogQXJpYWw7IGNvbG9yOiBuYXZ5OyI+IEluYy4g4oCTIDxhIGhyZWY9Imh0dHA6Ly93
d3cuc3BpZHluYW1pY3MuY29tLyIgdGFyZ2V0PSJfYmxhbmsiIG9uY2xpY2s9InJldHVybiB0b3Au
anMuT3BlbkV4dExpbmsod2luZG93LGV2ZW50LHRoaXMpIj4KaHR0cDovL3d3dy5zcGlkeW5hbWlj
cy5jb208L2E+PC9zcGFuPjwvZm9udD48L3A+Cgo8cD48Zm9udCBjb2xvcj0ibmF2eSIgZmFjZT0i
QXJpYWwiIHNpemU9IjIiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5
OiBBcmlhbDsgY29sb3I6IG5hdnk7Ij5QaG9uZTombmJzcDsgNjc4LTc4MS00ODAwPC9zcGFuPjwv
Zm9udD48L3A+Cgo8cD48Zm9udCBjb2xvcj0ibmF2eSIgZmFjZT0iQXJpYWwiIHNpemU9IjIiPjxz
cGFuIHN0eWxlPSJmb250LXNpemU6IDEwcHQ7IGZvbnQtZmFtaWx5OiBBcmlhbDsgY29sb3I6IG5h
dnk7Ij5EaXJlY3Q6Jm5ic3A7Jm5ic3A7IDY3OC03ODEtNDg0NTwvc3Bhbj48L2ZvbnQ+PC9wPgoK
PHA+PGZvbnQgZmFjZT0iVGltZXMgTmV3IFJvbWFuIiBzaXplPSIzIj48c3BhbiBzdHlsZT0iZm9u
dC1zaXplOiAxMnB0OyI+Jm5ic3A7PC9zcGFuPjwvZm9udD48L3A+Cgo8L3NwYW4+PC9kaXY+Cgo8
L2Rpdj4KCgoKPC9ibG9ja3F1b3RlPjwvZGl2PmNpYW8sPGJyPnBzdDxicj4K
------=_Part_40384_5852340.1168242230138--
Brought to you by http://www.webappsec.org
Search this site
|