Microsoft Internet Explorer Local Resource Enumeration Vulnerability

Bugtraq ID:	11621
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2004 12:00AM
Updated:	Nov 08 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to "Benjamin Tobias Franz" <[email protected]>.
Vulnerable:	Microsoft Internet Explorer 6.0 SP1
Not Vulnerable:

Microsoft Internet Explorer Local Resource Enumeration Vulnerability

Microsoft Internet Explorer is reported prone to a local resource enumeration vulnerability. It is reported that the vulnerability exists because when handling 'res://' requests for local resources, Internet explorer behavior may reveal the existence of local files.

An attacker may employ information that is harvested in this manner to aid in further attacks that are launched against a target computer.

Microsoft Internet Explorer Local Resource Enumeration Vulnerability

The following proof of concept exploit is available:

• /data/vulnerabilities/exploits/IEnumerate.txt

Microsoft Internet Explorer Local Resource Enumeration Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Internet Explorer Local Resource Enumeration Vulnerability

References:

• Technet Security (Microsoft)
  
• Microsoft Internet Explorer permits to examine the existence of local files ("Benjamin Tobias Franz" <[email protected]>)