Microsoft Internet Explorer Invalid ContentType May Disclose Cache Directory Location to Remote Users
|
|
SecurityTracker Alert ID: 1008293 |
|
SecurityTracker URL: http://securitytracker.com/id/1008293
|
|
CVE Reference:
CVE-2003-1028
(Links to External Site)
|
Updated: Jan 9 2004
|
Original Entry Date: Nov 26 2003
|
Impact:
Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 6 SP1, possibly earlier versions
|
Description:
A vulnerability was reported in Microsoft Internet Explorer (IE) in the processing of ContentType headers. A remote user can determine the location of the cache directory, which may facilitate various exploits.
It is reported that a remote user can act as a web server and return a specially crafted HTTP response to cause the connected IE browser to open a file in the cache directory with Internet zone security restrictions. The report indicates that when the ContentType is invalid and the filename has the 'htm' file extension, the browser will download the file and open the file in the cache directory. As a result, the HTML code in the file can return the location of the cache directory to the remote user.
A demonstration exploit is available at:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo.zip
It is reported that this exploit works on some but not all systems.
|
Impact:
A remote user can determine the location of the target user's cache directory.
|
Solution:
No solution was available at the time of this entry.
The author of the report indicates that you can disable Active Scripting in the Internet security zone.
|
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
|
Cause:
Access control error, State error
|
Underlying OS: Windows (Any)
|
Underlying OS Comments: Tested on Windows XP
|
|
Message History:
None.
|
Source Message Contents
|
Subject: Invalid ContentType may disclose cache directory
|
Invalid ContentType may disclose cache directory
[tested]
OS:WinXp, CN version
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16
[overview]
The problem lies in the download function of Internet Explorer. This can be exploited by malicious web pages to get cache directory
including random names.
[demo]
There are two harmless demos:
1st, online demo, powered by ASP:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo
2nd, demo in ZIP format, powered by NETCAT:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo.zip
[technical details]
When CONTENTTYPE in HTTP response is invalid and file extension is "HTM", the downloaded HTM file will be opened in cache directory,
in INTERNET security zone.
In the 1st demo, this is done by the following ASP code:
----------
response.ContentType = "whocares"
response.AddHeader "content-disposition", "inline; filename=test.htm"
----------
In the 2nd demo, this is done with the help of NETCAT.
[Workaround]
Disable Active Scripting in INTERNET zone, so HTML page opened in the cache can't send information back to the attacker.
[Greetings]
greetings to:
Drew Copley, dror, guninski and mkill.
-----
all mentioned resources can always be found at UMBRELLA.MX.TC
[people]
LiuDieyuinchina [N0-@-Sp2m] yahoo.com.cn
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"
[Employment]
I would like to work professionally as a security researcher/bug finder.
See my resume at my site. I am very eager to work, flexible, and
extremely productive. I have a top notch resume, with credentials
from leading bug finders. I am willing to work per contract, relocate,
or telecommute.
[Give a Hand]
I haven't got a job as a security researcher yet and my family don't support my security work - so, I don't have a computer of my
own. Please consider about donating at:
http://clik.to/donatepc
|
|
