Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
BID:8980
Info
Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
| Bugtraq ID: | 8980 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2003 12:00AM |
| Updated: | Nov 05 2003 12:00AM |
| Credit: | Discvoery is credited to Liu Die Yu <[email protected]>. |
| Vulnerable: |
Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
A vulnerability has been reported in Internet Explorer that may allow cached Internet content to be rendered in the My Computer zone. It is possible to exploit this issue by including an extra slash when referencing cached content from within a web page, for example:
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5
The extra slash prior to "Documents and Settings" will cause the referenced content to be handled in the context of the My Computer zone. Combined with other vulnerabilities, this issue could lead to execution of arbitrary code on the client system. A proof-of-concept has been released to demonstrate this issue may be exploited with other issues to cause execution of arbitrary code in the context of the client user. It should be noted that the proof-of-concept may only function correctly if the Internet Explorer cache is in the default location.
** A new proof-of-concept has been made available which uses the vulnerability described in BID 9106 to locate the Internet Explorer cache.
A vulnerability has been reported in Internet Explorer that may allow cached Internet content to be rendered in the My Computer zone. It is possible to exploit this issue by including an extra slash when referencing cached content from within a web page, for example:
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5
The extra slash prior to "Documents and Settings" will cause the referenced content to be handled in the context of the My Computer zone. Combined with other vulnerabilities, this issue could lead to execution of arbitrary code on the client system. A proof-of-concept has been released to demonstrate this issue may be exploited with other issues to cause execution of arbitrary code in the context of the client user. It should be noted that the proof-of-concept may only function correctly if the Internet Explorer cache is in the default location.
** A new proof-of-concept has been made available which uses the vulnerability described in BID 9106 to locate the Internet Explorer cache.
Exploit / POC
Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
Liu Die Yu has developed a proof of concept exploit to demonstrate arbitrary code execution using a combination of unpatched Internet Explorer vulnerabilities. Successful exploitation of these vulnerabilities combines results in the execution of a cached executable file supplied by an attacker. The issues known to be exploited in cobmination with the issue described in this BID, are described in the following BIDs:
BID 8886 - Microsoft Internet Explorer Local Resource Reference Vulnerability
BID 8577 - Multiple Microsoft Internet Explorer Script Execution Vulnerabilities
BID 3779 - Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror5-Demo.zip below.
http://www.safecenter.net/UMBRELLAWEBV4/execdror5/execdror5-MyPage.htm
A new exploit has been made available that also employs an exploit for the issue described in BID 9106. This allows the Internet Explorer cache to be located even if it is no longer in the default location.
The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror6-Demo.zip below.
http://www.safecenter.net/UMBRELLAWEBV4/execdror6/
Liu Die Yu has developed a proof of concept exploit to demonstrate arbitrary code execution using a combination of unpatched Internet Explorer vulnerabilities. Successful exploitation of these vulnerabilities combines results in the execution of a cached executable file supplied by an attacker. The issues known to be exploited in cobmination with the issue described in this BID, are described in the following BIDs:
BID 8886 - Microsoft Internet Explorer Local Resource Reference Vulnerability
BID 8577 - Multiple Microsoft Internet Explorer Script Execution Vulnerabilities
BID 3779 - Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror5-Demo.zip below.
http://www.safecenter.net/UMBRELLAWEBV4/execdror5/execdror5-MyPage.htm
A new exploit has been made available that also employs an exploit for the issue described in BID 9106. This allows the Internet Explorer cache to be located even if it is no longer in the default location.
The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror6-Demo.zip below.
http://www.safecenter.net/UMBRELLAWEBV4/execdror6/
Solution / Fix
Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
References:
References:
- execdror5 Demo Page (Liu Die Yu)
- Unpatched Internet Explorer Bugs (Liu Die Yu)
- RE: double slash moves cache from INTERNET zone to MYCOMPUTER zone ("Thor Larholm"