Vulnerability Development mailing list archives
Re: ie5 and .doc URLs
From: Jason.Haar () TRIMBLE CO NZ (Jason Haar)
Date: Mon, 12 Jun 2000 12:37:14 +1200
On Fri, Jun 09, 2000 at 02:39:00PM +0200, Olivier Thereaux wrote:
xxx - "GET /~yoda/document.doc HTTP/1.0" 200 83456 xxx - "OPTIONS /~yoda HTTP/1.0" 301 230 xxx - "GET /_vti_inf.html HTTP/1.0" 200 3042 xxx - "POST /_vti_bin/shtml.exe/_vti_rpc HTTP/1.0" 302 215 xxx - "OPTIONS /~yoda/document.doc HTTP/1.0" 200 -
I can confirm it's IE's way of seeing whether or not it has WRITE access to the file. The /_vti_inf.html style stuff is checking to see if you have FrontPage extensions, and the OPTIONS test is to see if you have WebDAV extensions - both possible ways of altering files via HTTP. You will find that their browser has something like Frontpage installed (or "M$ web editing" - something like that) - that then causes the above behaviour. Removing that component from their browser will stop the above action. We have had a LOT of random problems with that bl%%dy thing - users were getting "access denied" errors to .doc files stored on Apache web servers/etc... Typical M$.... -- Cheers Jason Haar Unix/Network Specialist, Trimble NZ Phone: +64 3 9635 377 Fax: +64 3 9635 417
Current thread:
- ADV: /con/con is yet exploitable on most fservs, (continued)
- ADV: /con/con is yet exploitable on most fservs Paulo Ribeiro (Jun 07)
- Re: ADV: /con/con is yet exploitable on most fservs Cam (Jun 08)
- Re: A<D>V: /con/con is yet exploitable on most fservs Niall Smart (Jun 08)
- weird bug found marco (Jun 09)
- Re: weird bug found hypoclear - lUSt - (Linux Users Strike Today) (Jun 09)
- ie5 and .doc URLs Olivier Thereaux (Jun 09)
- Re: ie5 and .doc URLs Chris Tobkin (Jun 09)
- Re: ie5 and .doc URLs Olle Segerdahl (Jun 09)
- mdaemon 2.8.5.0 DoS Craig (Jun 09)
- Re: ie5 and .doc URLs security-lists () SERVER KAPOW DK (Jun 09)
- Re: ie5 and .doc URLs Jason Haar (Jun 11)
- ADV: /con/con is yet exploitable on most fservs Paulo Ribeiro (Jun 07)
- Re: krb5 1.1.1 horio shoichi (Jun 07)
