Microsoft Internet Explorer Double Backslash CHM File Execution Weakness

Bugtraq ID:	10348
Class:	Origin Validation Error
CVE:	CVE-2004-0475
Remote:	Yes
Local:	No
Published:	May 14 2004 12:00AM
Updated:	Jul 12 2009 04:07AM
Credit:	Discovery is credited to Roozbeh Afrasiabi.
Vulnerable:	Microsoft Internet Explorer 6.0 SP1
Not Vulnerable:

Microsoft Internet Explorer Double Backslash CHM File Execution Weakness

A vulnerability has been reported in Microsoft Internet Explorer that may permit unauthorized execution of locally stored compiled help files (.CHM).

This issue reportedly permits a web page within the Internet Security Zone to execute .CHM files that are stored on the local system. Due to restrictions implemented in previous security updates, this type of access should only be permitted from the Local Zone.

This issue could be exploited with other existing vulnerabilities, such as BID 9658 to execute arbitrary code on the system.

Note: This BID was created because further research has determined it to be a distinct issue from the vulnerability described in 10344. BID 10344 describes an issue that permits unauthorized access to local resources via CODEBASE.

Microsoft Internet Explorer Double Backslash CHM File Execution Weakness

Proof-of-concept examples have been posted on the following web pages:

http://www.freewebs.com/roozbeh_afrasiabi/xploit/index.htm
http://www.freewebs.com/roozbeh_afrasiabi/xploit/root.htm

Microsoft Internet Explorer Double Backslash CHM File Execution Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Internet Explorer Double Backslash CHM File Execution Weakness

References:

• Re: Showhelp() local CHM file execution (roozbeh afrasiabi )
  
• Showhelp() local CHM file execution (roozbeh afrasiabi )