Results 1 to 7 of 7

Thread: Its IE - Again Again Again

  1. #1

    Its Ie - Again Again Again

    Greeting's

    Yup its IE and this thread is not about VML again.. It seems that there is a new vulnerability discovered right after VML patch came out .

    Vulnerability Note VU#753044
    Microsoft Windows WebViewFolderIcon ActiveX integer overflow


    Overview

    The Microsoft Windows WebViewFolderIcon ActiveX control contains an integer overflow vulnerability. This may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.


    I. Description
    The Microsoft WebViewFolderIcon object is an ActiveX control that comes with Microsoft Windows. This control, which is provided by the file webvw.dll, provides support functionality for icons in the Windows Explorer Web view. The slice method of the WebViewFolderIcon control contains an integer overflow vulnerability.



    II. Impact
    By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash.The complete impact of this vulnerability is not yet known.
    III. Solution

    : Solution.. is there a real solution.. either disable everything or use another browser.


    Here is the solution as mentioned at the source :

    Disable the WebViewFolderIcon ActiveX control

    The WebViewFolderIcon ActiveX control can be disabled by setting the kill bit for the following CLSID:

    {844F4806-E8A8-11d2-9652-00C04FC30871}

    More information about how to set the kill bit is available in Microsoft Support Document 240797.

    Disable ActiveX

    Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document and the Malicious Web Scripts FAQ.
    http://support.microsoft.com/kb/240797
    http://www.us-cert.gov/reading_room/...ernet_Explorer
    http://www.cert.org/tech_tips/malici..._FAQ.html#ie56


    Here is the CVE :
    http://cve.mitre.org/cgi-bin/cvename...=CVE-2006-3730



    PS : This is my 500th POST.
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  2. #2
    Dissident 4dm1n brokencrow's Avatar
    Join Date
    Feb 2004
    Location
    Shawnee country
    Posts
    1,243
    Surprise, surprise. IE7 should be out soon and we'll live happily ever after.
    “Everybody is ignorant, only on different subjects.” — Will Rogers

  3. #3
    AO Curmudgeon rcgreen's Avatar
    Join Date
    Nov 2001
    Posts
    2,716
    Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability
    In fact, disabling ActiveX pretty much turns IE into a safe browser.
    I came in to the world with nothing. I still have most of it.

  4. #4
    AO's MMA Fanatic! Computernerd22's Avatar
    Join Date
    Mar 2003
    Location
    Miami, FL
    Posts
    795
    In fact, disabling ActiveX pretty much turns IE into a safe browser.
    Takes more than that IMO. What about Java, Scripting (JavaScript, VBScript), JVM (java virtual machine) etc...


    may also introduce vulnerabilities to the computer system
    I would recommend going here for securing your web browser.

    http://www.cert.org/tech_tips/securing_browser/

  5. #5
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    This has been heavily exploited over the weekend. Site all over the world are hosting exploits for the SetSlice IE vulnerability.

    SANS has a killbit app to quickly solve the issue while you wait for an MS patch.
    http://isc.sans.org/diary.php?storyid=1742

    Eweek has a decent story on it.
    http://www.eweek.com/article2/0,1759,2022805,00.asp

    For the lazy, here is the bottom line on what's happening out there right this second. This is so massively exploited, it makes VML look cute. There's a rootkit, some other malware, and haxdor! (a phishing trojan horse).

    --TH13
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  6. #6
    @ÞΜĮЙǐЅŦГǻţΩЯ D0pp139an93r's Avatar
    Join Date
    May 2003
    Location
    St. Petersburg, FL
    Posts
    1,705
    Although yes, there are now patches/fixes for this vulnerability, this is something that should never have been exploitable to begin with.

    There is no excuse for allowing any active scripting in the Internet Zone.


    If you are compromised, it's your own damn fault. The problem is that people remain ignorant about computers and software, even though they spend thousands of dollars to get online. When you buy a car... you figure out how to change a flat tire, or change the oil, etc. The same applies with anything, but when it comes to computers, nobody puts any effort into it.
    Real security doesn't come with an installer.

  7. #7
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    When you buy a car... you figure out how to change a flat tire, or change the oil
    Well I pay someone to change my tires....and my oil....

    I cant know everything

    MLF
    How people treat you is their karma- how you react is yours-Wayne Dyer

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •