<BLOCKQUOTE><font size="1" face="Arial">quote:</font><HR><font face="Arial" size="3">Originally posted by fliptw:
and tells us about the upcoming patch</font><HR></BLOCKQUOTE>
Actually looking at this for a few minutes, that patch is for the 'previous' bug mentioned in the first post.
This particular bug is about embedding a CLSID into a filename to make it look like a particular extension when it's something else completely.
If you're running the proxomitron you can put in a filter in that fixes that issue.
[HTTP headers]
In = TRUE
Out = FALSE
Key = "Content-Disposition: IE Exploit Attachment-Spoof [Alert+Choice] (in)"
Match = "\1{\2}\3&$ALERT(*** WARNING ***\nIE Attachment-Spoof Exploit
Detected!\n\n\1{\2}\3)($CONFIRM(Allow only the attachment below? (Safest action
= NO)\n\n\1\3)|$SET(1=\k)$SET(3=))"
Replace = "\1\3"
or if you don't want dialog boxes
In = TRUE
Out = FALSE
Key = "Content-Disposition: Attachment Spoof removal"
Match = "(*)\1{*}(*)\2"
Replace = "\1\2"
This still causes it to display a different filename, but the file will not execute with the given CLSID properties (instead using the spoofed ones), thereby blocking the exploit, without removing correct Content-Disposition handling. I.e. if somebody gives you a link to an .exe, renamed to .pdf, with the .exe clsid, it'll open in acrobat instead of just running.
With **** like this happening, its a small wonder why people continue to use Idiot Exploiter...
Stay at current page" or w/e
