-
September 28th, 2006, 07:18 AM
#1
Its Ie - Again Again Again
Greeting's
Yup its IE and this thread is not about VML again.. It seems that there is a new vulnerability discovered right after VML patch came out .
Vulnerability Note VU#753044
Microsoft Windows WebViewFolderIcon ActiveX integer overflow
Overview
The Microsoft Windows WebViewFolderIcon ActiveX control contains an integer overflow vulnerability. This may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
I. Description
The Microsoft WebViewFolderIcon object is an ActiveX control that comes with Microsoft Windows. This control, which is provided by the file webvw.dll, provides support functionality for icons in the Windows Explorer Web view. The slice method of the WebViewFolderIcon control contains an integer overflow vulnerability.
II. Impact
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash.The complete impact of this vulnerability is not yet known.
III. Solution
: Solution.. is there a real solution.. either disable everything or use another browser.
Here is the solution as mentioned at the source :
Disable the WebViewFolderIcon ActiveX control
The WebViewFolderIcon ActiveX control can be disabled by setting the kill bit for the following CLSID:
{844F4806-E8A8-11d2-9652-00C04FC30871}
More information about how to set the kill bit is available in Microsoft Support Document 240797.
Disable ActiveX
Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document and the Malicious Web Scripts FAQ.
http://support.microsoft.com/kb/240797
http://www.us-cert.gov/reading_room/...ernet_Explorer
http://www.cert.org/tech_tips/malici..._FAQ.html#ie56
Here is the CVE :
http://cve.mitre.org/cgi-bin/cvename...=CVE-2006-3730
PS : This is my 500th POST.
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
September 28th, 2006, 11:25 AM
#2
Surprise, surprise. IE7 should be out soon and we'll live happily ever after.
“Everybody is ignorant, only on different subjects.” — Will Rogers
-
September 29th, 2006, 05:18 AM
#3
Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability
In fact, disabling ActiveX pretty much turns IE into a safe browser.
I came in to the world with nothing. I still have most of it.
-
September 29th, 2006, 05:36 AM
#4
In fact, disabling ActiveX pretty much turns IE into a safe browser.
Takes more than that IMO. What about Java, Scripting (JavaScript, VBScript), JVM (java virtual machine) etc...
may also introduce vulnerabilities to the computer system
I would recommend going here for securing your web browser.
http://www.cert.org/tech_tips/securing_browser/
-
October 1st, 2006, 12:02 PM
#5
This has been heavily exploited over the weekend. Site all over the world are hosting exploits for the SetSlice IE vulnerability.
SANS has a killbit app to quickly solve the issue while you wait for an MS patch.
http://isc.sans.org/diary.php?storyid=1742
Eweek has a decent story on it.
http://www.eweek.com/article2/0,1759,2022805,00.asp
For the lazy, here is the bottom line on what's happening out there right this second. This is so massively exploited, it makes VML look cute. There's a rootkit, some other malware, and haxdor! (a phishing trojan horse).
--TH13
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
-
October 3rd, 2006, 08:21 PM
#6
Although yes, there are now patches/fixes for this vulnerability, this is something that should never have been exploitable to begin with.
There is no excuse for allowing any active scripting in the Internet Zone.
If you are compromised, it's your own damn fault. The problem is that people remain ignorant about computers and software, even though they spend thousands of dollars to get online. When you buy a car... you figure out how to change a flat tire, or change the oil, etc. The same applies with anything, but when it comes to computers, nobody puts any effort into it.
Real security doesn't come with an installer.
-
October 4th, 2006, 03:16 AM
#7
When you buy a car... you figure out how to change a flat tire, or change the oil
Well I pay someone to change my tires....and my oil....
I cant know everything
MLF
How people treat you is their karma- how you react is yours-Wayne Dyer
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|