Microsoft Active Movie Control Filetype Vulnerability

Bugtraq ID:	1221
Class:	Input Validation Error
CVE:	CVE-2000-0400
Remote:	Yes
Local:	Yes
Published:	May 13 2000 12:00AM
Updated:	Jul 11 2009 01:56AM
Credit:	Posted to Bugtraq on May 13, 2000 by <[email protected]>.
Vulnerable:	Microsoft Active Movie Control 1.0 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 2000 + Microsoft Internet Explorer 5.0 for Windows 2000
Not Vulnerable:

Microsoft Active Movie Control Filetype Vulnerability

The Microsoft Active Movie Control (a multimedia ActiveX control) will download files of any type specified in the control parameters in an HTML document, regardless of whether or not they are a valid media type. A hostile website, HTML email or HTML newsgroup post could therefore write executables and other potentially harmful content to target machines, which will be stored with their known filenames in the default Windows Temp directory.

This vulnerability could be used in conjunction with other exploits to run arbitrary code on the target machine(s).

Microsoft Active Movie Control Filetype Vulnerability

The following script assumes a default Windows Temp folder of c:\windows\temp

<OBJECT classid=clsid:05589FA1-C356-11CE-BF01-00AA0055595A height=1
style="DISPLAY: none" width=1>
<PARAM NAME="Filename" VALUE="C:\WINDOWS\TEMP\MALWARE.exe">

Microsoft Active Movie Control Filetype Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Active Movie Control Filetype Vulnerability

References: