Microsoft Exploit

Hey just to let you people know the Default on IE 6 says to prompt the user if an unsigned Active X control is downloaded, well Microsoft fubared and it won't even tell you. So make sure to change that. Check your clone browsers too..


Good Job Preacher!

Korp Death--In response to your Tiny request

I am running Win Me, with Norton av, AVG av, AND Tiny personal firewall, and my calculator popped up just as pretty as a picture.....and I update my av daily.

Okay, now I am going to turn my computer off....thought I was relatively safe!!

@!&#!(!&#@

:eek:

Quote:

---

Originally posted here by zigar
Updated NAV 2001 (defs dated 03/08) did NOT catch it...

Sygate did NOT catch it....

there is no hotfix at m$ yet...

this may in fact be the worst freakin exlpoit yet....

FORMAT C:??!!!!???? for f8ck sake....i'm so pissed right now...

thnx for the heads up Euclid

---

just so you know, i have yet to see any evidence that there is a way do anything other than open the program, so as we know it, there is no possible way to format the c drive(unless the box has already been compromised and there is a known exe or batch file that may be run to do so).

FYI -
Under IE 5.00, and 6.0 (accoriding to Preacher) you can disable the 'Download unsigned ActiveX controls', and it will stop the .exe from running. In IE 5.5 SP2, you can disable the ActiveX all you want, and the exe is still going to run.

well...i'm running 5.5 here...so it does run....

HOWEVER THERE IS A FIX...

Quote:

---

Update - 3 Mar 2002
Since the injected <object> runs in the "My Computer" Zone changing the Internet Zone's settings didn't affect it, but changing the correct zone's settings will prevent this exploit from running.
Here is the registry information:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
Change the value of "1004" (DWORD) to 0x3.
Many thanks to Axel Pettinger and Garland Hopkins for this workaround.

---

from http://security.greymagic.com/adv/gm001-ie/


here's something interesting...

in searching i found THIS page

which does trigger NAV....

and the page that euclid posted does NOT???...

having looked at the source...the nasty part of the code

Quote:

---

<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span>
<xml id="oExec">
<security>
<exploit>
<![CDATA[
<object id="oFile" classid="clsid:11111111-1111-1111-1111-111111111111" codebase="c:/winnt/system32/calc.exe"></object>
]]>
</exploit>
</security>
</xml>

---

is exactly the same...so question is why is NAV finding one...but not the other...also...even though NAV does detect the file...it still allows the code (calc.exe) to be run...nice...

Quote:

---

yet to see any evidence that there is a way do anything other than open the program

---

if it can be done....it will be done...and looks like it might already have been...check this out...with particular attention to the last paragraph

http://www.hackcanada.com/ice3/misc/...rcefeeding.txt

Yeah it worked on my ME box, I'm also running TPF. But I suppose firewalls wouldn't really have anything to do with it.