Bofra/IFrame Exploits on More Web Sites

Article View: be.comp.security

Article #779

#779

From: Filbert
Date: Sun, 21 Nov 2004 08:51

13 lines
1421 bytes

The Storm Center received a report this morning of a high profile UK website
that contains a pointer on their main page to another URL hosting the
Bofra/IFrame exploit. We have confirmed that if this site is visited using
Internet Explorer the exploit will be downloaded. The site owners have been
notified.

http://isc.sans.org/diary.php?date=2004-11-20


-- 
echo "+++ATH0filb+++ATH0@linuxmail.org" | sed 's/+++ATH0//g'
 "Remotely-exploitable vulnerability in W2K. Reported: 2/8/2004"
 http://www.eeye.com/html/research/upcoming/20040802-C.html

Technical Details

Message-ID: <1456890.jBi8I4zSqs@127.0.0.1>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!nerim.net!feed1.news.be.easynet.net!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: 113446,10b2d828c15bd8b2,start
X-Google-Attributes: gid113446,public
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!proxad.net!nerim.net!feed1.news.be.easynet.net!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail
Message-ID: <1456890.jBi8I4zSqs@127.0.0.1>
From: Filbert <filb@spam.la>
Subject: Bofra/IFrame Exploits on More Web Sites
Newsgroups: be.comp.security
Reply-To: +++ATH0filb@+++ATH0linuxmail.org
Lines: 14
Organization: /dev/null
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7Bit
Date: Sun, 21 Nov 2004 08:51:48 GMT
NNTP-Posting-Host: 213.118.231.106
X-Complaints-To: abuse@telenet.be
X-Trace: phobos.telenet-ops.be 1101027108 213.118.231.106 (Sun, 21 Nov 2004 09:51:48 MET)
NNTP-Posting-Date: Sun, 21 Nov 2004 09:51:48 MET