Comments on: XSS Vulnerability in Internet Explorer HTML Attachment Download http://www.awgh.org/archives/57 Shaking Your Tree Wed, 23 Nov 2011 06:47:42 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Stephen http://www.awgh.org/archives/57/comment-page-1#comment-6722 Stephen Mon, 27 Jun 2011 18:36:33 +0000 http://www.awgh.org/?p=57#comment-6722 I don't know why you say "Now IE8 behaves like Firefox". Your example page still shows the problem in Internet Explorer 8 when I test it. It's fixed in IE9, though. IE9 behaves like Firefox. For IE8, the "noopen" header is needed for MOST files, not just HTML, due to IE's mime-type sniffing algorithm. Serving a file as application/octet-stream? Need to disallow "Open" because it may get sniffed as HTML! And "nosniff" doesn't seem to have any effect in combination with with "attachment". I don’t know why you say “Now IE8 behaves like Firefox”. Your example page still shows the problem in Internet Explorer 8 when I test it.

It’s fixed in IE9, though. IE9 behaves like Firefox.

For IE8, the “noopen” header is needed for MOST files, not just HTML, due to IE’s mime-type sniffing algorithm. Serving a file as application/octet-stream? Need to disallow “Open” because it may get sniffed as HTML!

And “nosniff” doesn’t seem to have any effect in combination with with “attachment”.

]]> By: HackTalk http://www.awgh.org/archives/57/comment-page-1#comment-5714 HackTalk Mon, 02 Aug 2010 20:40:45 +0000 http://www.awgh.org/?p=57#comment-5714 <strong>Shell of the Future v0.9.0.2 Released...</strong> This was a really good post I mentioned it on my blog... Shell of the Future v0.9.0.2 Released…

This was a really good post I mentioned it on my blog…

]]> By: Minh http://www.awgh.org/archives/57/comment-page-1#comment-3196 Minh Thu, 16 Jul 2009 19:43:52 +0000 http://www.awgh.org/?p=57#comment-3196 Yeah, I totally agree - firefox handles this far better. Do you know of any way of handling this issue for older versions of IE 6 & 7? Yeah,

I totally agree – firefox handles this far better.

Do you know of any way of handling this issue for older versions of IE 6 & 7?

]]>