(Exploit is Available) Microsoft IE Double Byte Parsing Flaw Lets Remote Users Spoof URLs in the Addresses Bar
|
|
SecurityTracker Alert ID: 1012343 |
|
SecurityTracker URL: http://securitytracker.com/id/1012343
|
|
CVE Reference:
CAN-2004-0844
(Links to External Site)
|
Date: Nov 28 2004
|
Impact:
Modification of system information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 6
|
Description:
Avulnerability was reported in Microsoft Internet Explorer (IE) in the processing of double byte character sets. A remote user can cause an arbitrary URL to be listed in the address bar.
Microsoft reported that there is a flaw in the canonicalization of addresses when parsing special characters in an HTTP URL on Double Byte Character Set (DBCS) systems, such as on Asian character set systems.
Microsoft reported that a remote user can create HTML code that will cause IE to display an arbitrary URL in the address bar while displaying a different web site in the browser window.
A remote user can exploit this to spoof web sites.
Liu Die Yu has provided a demonstration exploit example, available at:
http://umbrella.name/originalvuln/msie/DieSlowlyThisTime/DieSlowlyThisTime.html
|
Impact:
A remote user can cause an arbitrary URL to be listed in the address bar.
|
Solution:
The vendor has issued a fix.
Internet Explorer 5.01 Service Pack 3 on Windows 2000 SP3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2D8E8E97-4946-4994-924B-1FB1DC1881BA&displaylang=en
Internet Explorer 5.01 Service Pack 4 on Windows 2000 SP4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=72DBE239-AF0A-42B5-B88C-A00371F6EC81&displaylang=en
Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Me:
http://www.microsoft.com/downloads/details.aspx?FamilyId=BE27F77C-3C2D-45F1-86DF-2B71799DA169&displaylang=en
Internet Explorer 6 on Windows XP:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A89CFBE8-C299-415D-A9D6-7CC6429C547D&displaylang=en
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, on Microsoft Windows XP, or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7C1404E6-F5D4-4FED-9573-DD83F2DFF074&displaylang=en
Internet Explorer 6 Service Pack 1 on Microsoft Windows NT Server 4.0 Service Pack 6a, on Microsoft Windows NT Server 4.0 Terminal Service Edition Service Pack 6, on Microsoft Windows 98, on Microsoft Windows 98 SE, or on Microsoft Windows Me:
http://www.microsoft.com/downloads/details.aspx?FamilyId=DE8D94C4-7F58-4CE7-B8BD-51CFD795B03E&displaylang=en
Internet Explorer 6 for Windows XP Service Pack 1 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C05103E8-4402-4D54-BA03-FBBC24142E4D&displaylang=en
Internet Explorer 6 for Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=19E69E5F-9C98-49AD-A61F-4F82A4014412&displaylang=en
Internet Explorer 6 for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=566C2A05-2513-4E30-A3EA-87D4BF7F9730&displaylang=en
Internet Explorer 6 for Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CF47B515-3F51-43E1-9246-2C2264C49E2E&displaylang=en
These patches require a system restart.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-038.mspx (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Sun, 28 Nov 2004 23:55:08 +0800
Subject: [Full-Disclosure] Address Bar Spoofing on Double Byte Character Set Locale Vulnerability
|
Overview
========
On "Double Byte Character Set Locale" systems(Chinese, Japanese, etc),
there exists a spoofing vulnerability within Microsoft Internet Explorer
that enables attackers to fake the Address field.
Exploit
=======
http://umbrella.name/originalvuln/msie/DieSlowlyThisTime/DieSlowlyThisTime.html
Patch
=====
http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx
Details
=======
The research started when I found:
Input %fe@umbrella.name in the address field and press ENTER: MSIE will
go to the homepage of Umbrella.name, but the address field will display
"http://@umbrella.nam/e". After playing this for several times, I made
the exploit mentioned above.
I still do not know the mechanism behind this bug.
It may be helpful to read the official description of this issue from
Microsoft TechNet
-----QUOTE-START-----
Aspoofing vulnerability exists in Internet Explorer's processing of URLs
on Double Byte Character Set systems. This vulnerability could result in
an incorrect URL being listed in the Address bar that is not the actual
Web page that is displayed by Internet Explorer.
-----QUOTE-ENDOF-----
"Aspoofing" - http://www.onelook.com/?w=aspoofing&ls=a
(
Look up "Aspoofing" in your English dictionary, then you can learn
how carefully they prepared this security bulletin.
To learn more about MSRC, don't miss: A Tour of the Microsoft
Security Response Center (MSRC)
http://umbrella.name/originalvuln/msie/DieSlowlyThisTime/DieSlowlyThisTime-msrc_explained.html
)
Credit
======
Liu Die Yu - http://umbrella.name/
Send to Friend
==============
http://editive.com/referrer
Greetings
=========
Drew Copley, Malware, Guninski, Feng4ever, Jelmer, Zhouwei, mom and dad.
##### END OF FILE #####
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
