--Boundary_(ID_BUnokhYfmlvgvnrASlfJWQ)
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: quoted-printable
Running Windows NT 4.0/sp3 and I.E. 4.0 (4.71.1712.6) 128-bit =
extensions:
res://abcdefghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456abc=
defghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456abcdefghijkl=
mnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstu=
vwxyz123456abcdefghijklmnopqrstuvwxyz123456abcd/
returns:
/-
Internet Explorer cannot open the internet site ".."=20
The specified module could not be found.
\-
but
res://abcdefghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456abc=
defghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456abcdefghijkl=
mnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstu=
vwxyz123456abcdefghijklmnopqrstuvwxyz123456abcde/
and longer strings return:
/-
Internet Explorer cannot open the internet site ".."=20
The filename or extension is too long.
\-
looks like a win95 centric bug to me. Note that I didn't try the =
exploit.. :-)
-----Original Message-----
From: DilDog <dildog@L0PHT.COM>
To: BUGTRAQ@NETSPACE.ORG <BUGTRAQ@NETSPACE.ORG>
Date: Monday, November 10, 1997 12:37 PM
Subject: L0pht Advisory: IE4.0
=20
=20
Document: L0pht Security Advisory
URL Origin: http://l0pht.com/advisories.html
Release Date: November 1st, 1997
Application: Microsoft Internet Explorer 4.0 Suite
Severity: Viewing remote HTML content can execute arbitrary =
native code
Author: dildog@l0pht.com
Operating Sys: Windows 95
=20
=3D=3D=3D=3D=3D=3D=3D=3D
Scenario
=3D=3D=3D=3D=3D=3D=3D=3D
=20
The Microsoft Internet Explorer 4.0 Suite, including all programs =
supplied
with it that read and/or process HTML from either local machines, =
intranet
machines, or remote internet machines are subject to a buffer =
overflow in the
HTML decoding process. The buffer overflow can cause the =
application to page
fault, or in the worst case, execute arbitrary precompiled native =
code.
=20
=3D=3D=3D=3D=3D=3D=3D
Example
=3D=3D=3D=3D=3D=3D=3D
=20
1. Copy the supplied HTML file(s) into a location that is =
accessible via the
target application.
2. Point to it. Look at it.
3. Click on the link. (or let someone click it for you)
4. Become aware of what happens to your machine.
5. Freak out and beg Microsoft to make the bad man stop.
=20
The critical problem here is a buffer overflow in the parsing of a =
particular
new type of URL protocol. The "res://" type of URL is meant to =
allow access
to a local resource embedded in a local DLL file. This is useful =
for
archiving entire websites into a DLL and is not, in its truest =
concept, a
security flaw.
=20
For example, to read something out of the IE4.0 Tour (stored in a =
DLL) try
the following URL: res://ie4tour.dll/page1-6.htm
=20
The buffer overflow is on the actual filename specified. To crash =
your
machine go ahead and try res://blahblahblah ... blahblah/ in your =
Internet
Explorer window where the amount of 'blah' equals 265 characters.
=20
The function that goes through the filename and validates it is =
flawed on
Windows 95. Without checking the length, the filename is =
uppercased,
concatenated with '.DLL' if it isn't there already, and in the =
process,
copied into a fixed size buffer.
=20
=3D=3D=3D=3D=3D=3D=3D=3D
Solution
=3D=3D=3D=3D=3D=3D=3D=3D
=20
Currently, there is no solution available for this flaw. You can't =
set any
Internet Explorer options to avoid it, and you are not protected =
by any
level of zone security. Simply don't surf the web, read email or =
view
net news using Internet Explorer 4.0 until Microsoft puts up a =
hotfix.
=20
--Boundary_(ID_BUnokhYfmlvgvnrASlfJWQ)
Content-type: text/html; charset=iso-8859-1
Content-transfer-encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">