[22260] in bugtraq
Re: HTML Form Protocol Attack
daemon@ATHENA.MIT.EDU (Barnaby Gray)
Wed Aug 15 22:52:20 2001
Date: Thu, 16 Aug 2001 02:49:12 +0100
From: Barnaby Gray <bgrg2@cam.ac.uk>
To: bugtraq@securityfocus.com
Message-ID: <20010816024912.A14332@purple.chu.cam.ac.uk>
Mail-Followup-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3B7AFE81.3050704@ip23.net>
On Thu, Aug 16, 2001 at 12:58:09AM +0200, Sevo Stille wrote:
> For ports below 80. There are a lot of other potentially vulnerable
> services above 80. pop3 in particular is used by the largest German ISP
> without password authentication (users are authenticated through their
> temporary IP address and associated Radius information), so the
> described pop3 deletion attacks against their users email would very
> trivial.
Yep, and worse because IE was tested as vulnerable I believe.
> >but gets stuck halfway through
> >the transmission, without submitting the evil data.
>
> Not stuck - unless you send a carefully crafted form faking a ftp
> session, the ftp server would be waiting for some valid ftp commands to
> roll in.
>
You're right, after attempted again I managed to get it to login to my
FTP server, but ftp was not the best protocol to try it on considering
the way data back from the server is sent, which there's no way of
fiddling.
Barnaby
