Test de navigateurs

[megataupe]

Vu sur le forum d'assiste.com

 

http://terroirs.denfrance.free.fr/forum_cu...opic.php?t=2379

 

mais pas dans les news de zébulon (les vacances ou j'ai mal vu ?)

 

 

Bonjour,

 

Que pensez vous de ce test de sécurité:

 

http://bcheck.scanit.be/bcheck/

 

Dear Customer,

 

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

Mozilla Firefox 0.9.2

[tiklyt]

Salut et bonne trouvaille Megataupe

 

Dear Customer,

 

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

Mozilla Firefox 0.9

 

 

[NIKOSIX]

rien de neuf :

 

Dear Customer,

 

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

Firefox 0.8

[HeAdLeSs]

Dear Customer,

 

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

 

mozilla 1.7.1

[higgins]

Bonsoir,

 

 

Dear Customer,

 

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

Mozilla Firefox 0.9.1

 

 

pourquoi personnes sous IE ne fait ce test??!!

 

@+

[megataupe]

Z'ont les boules peut être de voir des failles trouvées par ce test qui me semble crédible, puisque Belge une fois, et aussi qu'on leur dise de changer de butineur comme remède.

[tiklyt]

bon après firefox, j'ai "quand même" fait le test avec Myie2.

 

Dear Customer,

 

The Browser Security Test is finished. Please find the results below:

 

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

MyIe2

 

Mais je resterais quand même sous Firefox.

[megataupe]

Je viens de le faire avec NetCaptor et ça donne le résultat suivant :

 

High Risk Vulnerabilities

Internet Explorer Modal Dialog Argument Caching Cross-Domain Scripting Vulnerability (jel20040607)

Description

This bug allows a malicious web page to execute any programs on your computer. A malicious hacker can take complete control over your computer using this bug. The bug can be exploited by a web page you browse or HTML email mesage you open.

 

This bug was discovered "in the wild" and is used by malicious web sites to install adware on visitors' computers.

 

Technical Details

This cross-domain scripting vulnerability allows executing JavaScript code in the context of any domain. Combined with other Internet Explorer vulnerabilities it allows executing code in Local Computer security zone, leading to installation and execution of arbitrary programs.

 

First a malicious page creates an IFRAME pointing that redirects to a page in the target domain (or Local Computer zone). Then a modal dialog is created and the reference to the IFRAME is passed to the dialog in dialogArguments parameter of showModalDialog function.

 

The modal dialog caches the reference to the IFRAME and waits until IFRAME's domain changes due to the redirect. Then the dialog page closes itself and returns the cached reference.

 

The original page receives the window reference from the modal dialog and changes the location of this window to a javascript: URL. The JavaScript code gets executed in the context of the domain to which the IFRAME was redirected.

 

Recommendations

There is no patch currently available to fix this problem. Updating your antivirus software with latest signatures can limit the consequences of a successful exploit.

 

Additional Information

 

Rafel Ivgi, The-Insider. 180 Solutions Exploits and Toolbars Hacking Patched Users. NTBugTraq Posting.

Jelmer. Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

 

Microsoft Internet Explorer Object Data Remote Execution Vulnerability (eeye20030821)

Description

This bug allows a malicious web page to execute any programs on your computer. A malicious hacker can take complete control over your computer using this bug. The bug can be exploited by a web page you browse or HTML email mesage you open.

 

Technical Details

Internet Explorer supports OBJECT tags which allow web pages to include ActiveX controls. Internet Explorer can be instructed to download the control from an URL specified in the OBJECT tag.

 

When it downloads the control it check if it needs to ask user's permission to execute it using the filename extension of the downloaded file. If the extension is "safe" the browser attempts to display it without asking the user.

 

However when diplaying the control, it uses "Content-Type" header to decide how to display the control. So a website can create a page with .html file name extension, but specify "Content-Type: application/hta" when sending the page to the browser. The browser will open the page without asking the user and execute it as if it is an HTA application, without applying any security restrictions on the actions of that page. The page can call any objects, and using the WScript.Shell object execute arbitrary commands on the client computer.

 

Recommendations

We recommend using Windows Update to correct this problem.

 

Additional Information

 

Microsoft Security Bulletin MS03-040

October 2003, Cumulative Patch for Internet Explorer (828750)

eEye Security Advisory. Internet Explorer Object Data Remote Execution Vulnerability

Http-equiv's Exploit Variant

GreyMagic Software Exploit Variant

 

Firefox reste imperturbable lui.

 

Bonne démonstration en direct donc car, F-Secure m'a immédiatement signalé l'envoi de cet Exploit avant que de le nettoyer.

[ipl_001]

Bonjour megataupe,

 

LOL aussi par Sebastien.B sur PC Astuces...

The Browser Security Test is finished. Please find the results below:

 

High Risk Vulnerabilities 0

Medium Risk Vulnerabilities 0

Low Risk Vulnerabilities 0

 

(MyIE2/IE6SP1)

[megataupe]

Ben, je trouve que l'on se marre bien avec ce test. Par contre, avec Firefox j'ai pas vu le média player se lancer comme avec NetCaptor. As-tu une explication ? Je précise que j'avais Updaté IE6 il n'y a pas longtemps car, il me sert de roue de secours pour quelques sites.