Kurt Huwig just released a vulnerability in the way the IE correctly handles ASCII encoding. It’s a pretty tricky flaw, that really is more of a problem in Firefox and Operat that they don’t also have the flaw, but the end result is that many forms of content filters will not be able to see the text when encoded in this way.

This is the link to the proof of concept page that shows text saying “The Magic Words are Squeamish Ossifrage” (view it in Firefox and IE to see the difference). Pretty interesting implications for the AV and content filtering world. I’ll be interested to see what the patches end up looking like when this is fixed.

This entry was posted on Wednesday, June 21st, 2006 at 1:49 pm and is filed under Webappsec. Responses are currently closed, but you can trackback from your own site.