Lucene search
K

msie.5.typedURL.ftp.address.txt

🗓️ 17 Aug 1999 00:00:00Reported by Packet StormType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 21 Views

Internet Explorer 5 connects to FTP sites before displaying address list, causing delays and issues.

Code
`Date: Thu, 6 May 1999 12:14:51 -0600  
From: Mark <[email protected]>  
To: [email protected]  
Subject: Odd Behavior in IE5  
  
  
Has anyone noticed this?  
  
After you visit an FTP site, IE5 places that URL in the TypedURLs list (just  
like it does with Web site addresses,) as seen in the drop down "Address"  
list at the top of the screen in IE5 (TypedURLs is the registry key under  
HKEY_CURRENT_USER where these entries are stored.) Then if you open a new  
instance of IE5 and click on the "Address" drop down list, there is a slight  
delay before the list is actually displayed -- and if you watch the network,  
there is activity on the network while this delay is taking place.  
  
After putting a sniffer to work to catch this network activity, it appears  
that IE5 will actually make a connection to every FTP site listed in the  
Address drop down list *before* displaying the Address list -- this is what  
causes the delay in displaying the list of TypedURLs in the Address drop  
down list.  
  
I haven't the foggiest idea why this needs to occur -- it makes no sense to  
me, and certainly places a burden on a given FTP server as well as putting  
unnecessary traffic on intranets and the internet -- not to mention any  
security logs that track these connections -- plus it causes a significant  
delay in displaying the Address list, especially if a FTP site is not  
answering...  
  
I wish I'd stuck with IE 4.x - doh.  
  
Mark  
  
-----------------------------------------------------------------------------  
  
Date: Fri, 7 May 1999 08:42:05 -0400  
From: Margaret Leber <[email protected]>  
To: [email protected]  
Subject: Re: Odd Behavior in IE5  
  
Mark <[email protected]> wrote:  
  
> Has anyone noticed this?...that IE5 will actually make a connection to every  
> FTP site listed in the Address drop down list *before* displaying the Address list --  
  
I'll bet this is related to the behavior noted by Ken Williams  
<[email protected]> back in April that IE5 attempts to fetch  
favicon.ico from sites when you bookmark them. It sounds like an  
outgrowth of the "integrated explorer" philosophy that manifests when  
you start treating local filesystem folders like websites (looking for  
display text and backgrounds in default "standard" filenames and the  
like).  
  
Treating a local folder as if it's a remote server is one thing.  
Treating a remote server as if it's a local filesystem is quite another.  
It generates unwanted and spurious network traffic, and broadcasts what  
a workstation user is up to.  
  
Requests to remote servers are *much* more expensive (to *both* ends of  
the conversation) than local filesystem access, and IMHO shouldn't be  
happening if the user didn't explicitly ask for them. These behavors are  
startling and counterintuitive. I'm so tired of suddenly having the  
lights go off in the kitchen when I flush the toilet, without knowing  
why. Somebody in Redmond needs to read "The Psychology of Everyday  
Things".  
  
MS seems to think that these kinds of "decommoditizations" are a  
value-add. I disagree.  
  
--  
<pre> ___________________________________________________________  
...../__ __) Margaret Stephanie Leber <[email protected]> /  
..../(, /| /| http://www.voicenet.com/~maggie/maggie.html /  
.../ / | / | _ _ _ ` _"The art of progress consists/  
../ ) / |/ |_(_(_(_/_(_/__(__(/_ of preserving order amid /  
./ (_/ ' .-/ .-/ change and change amid order."/  
/________________(_/ (_/___________________A.N.Whitehead___/</pre>  
  
-----------------------------------------------------------------------------  
  
Date: Fri, 7 May 1999 09:43:01 -0400  
From: Glen R. J. Neff <[email protected]>  
To: [email protected]  
Subject: Re: Odd Behavior in IE5  
  
I too have noticed some problems with FTP in IE5. I noticed them in the  
betas as well, but I thought they were so blatantly obvious that I didn't  
report 'em.  
  
The problems I've observed are with how IE5 handles passive FTP. They've  
been especially apparent to me because my NT boxes at home are behind Linux  
IP Masq., which requires passive mode for outgoing FTP, as does our firewall  
here at work.  
  
I've always surmised that IE4, which handles it fine, first attempts FTP  
connections in non-passive mode, then switches to passive mode if necessary.  
  
In IE5, if you select an FTP link which points directly to a file  
(ftp://ftp.acme.com/pub/subdir/file.zip) it will switch to passive mode and  
pull the file just fine. But if you attempt to hit a URL that specifies a  
directory on an FTP server (ftp://ftp.acme.com/pub/), after a long pause,  
you'll get an error dialogue like:  
  
An error occurred opening that folder on the FTP Server.  
Make sure you have permission to access that folder.  
  
Detail:  
200 Type Set to A.  
200 PORT command successful.  
425 Can't build data connection: Operation timed out.  
  
Likewise, here's an example of the output from NT's command line FTP client  
which has no support for passive mode:  
  
D:\>ftp ftp.cdrom.com  
Connected to wcarchive.cdrom.com.  
220 wcarchive.cdrom.com FTP server (Version DG-3.1.27 Wed Dec 2 01:29:08 PST  
1998) ready.  
User (wcarchive.cdrom.com:(none)): anonymous  
331 Guest login ok, send your email address as password.  
Password:  
230-Welcome to wcarchive - home FTP site for Walnut Creek CDROM.  
<snip>  
230 Guest login ok, access restrictions apply.  
ftp> ls  
200 PORT command successful.  
425 Can't build data connection: Connection refused.  
ftp>  
  
And to really demonstrate my point, here's some sample output from a UN!X  
based FTP client:  
  
gneff@jedi-/home/gneff$ ftp ftp.cdrom.com  
Connected to wcarchive.cdrom.com.  
220 wcarchive.cdrom.com FTP server (Version DG-3.1.27 Wed Dec 2 01:29:08 PST  
1998) ready.  
Name (ftp.cdrom.com:gneff): anonymous  
331 Guest login ok, send your email address as password.  
Password:  
230-Welcome to wcarchive - home FTP site for Walnut Creek CDROM.  
<snip>  
230 Guest login ok, access restrictions apply.  
Remote system type is UNIX.  
Using binary mode to transfer files.  
ftp> ls  
200 PORT command successful.  
425 Can't build data connection: Connection refused.  
ftp> passive  
Passive mode on.  
ftp> ls  
227 Entering Passive Mode (209,155,82,18,32,226)  
150 Opening ASCII mode data connection for 'file list'.  
total 91760  
-rw-rw-r-- 1 root wheel 696 Nov 19 1997 README  
<snip>  
drwxrwxr-x 2 root wheel 2048 May 6 21:26 pub  
226 Transfer complete.  
ftp>  
  
Can anyone else collaborate the problems with IE5 I've outlined here?  
  
Glen R. J. Neff  
NT Administrator  
Cable & Wireless Internet Operations Center  
  
"There is no spoon."  
  
-----Original Message-----  
>From: Windows NT BugTraq Mailing List  
[mailto:[email protected]] On Behalf Of Mark  
Sent: Thursday, May 06, 1999 14:15  
To: [email protected]  
Subject: Odd Behavior in IE5  
  
Has anyone noticed this?  
  
<snip>  
  
After putting a sniffer to work to catch this network activity, it appears  
that IE5 will actually make a connection to every FTP site listed in the  
Address drop down list *before* displaying the Address list -- this is what  
causes the delay in displaying the list of TypedURLs in the Address drop  
down list.  
  
<snip>  
  
I wish I'd stuck with IE 4.x - doh.  
  
Mark  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Aug 1999 00:00Current
7.4High risk
Vulners AI Score7.4
21