SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Microsoft Internet Explorer Vendors:   Microsoft
Microsoft Internet Explorer Flaw in Processing '.lnk' Shortcuts Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1008583
SecurityTracker URL:  http://securitytracker.com/id/1008583
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 2 2004
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 6.0 and prior versions
Description:   A vulnerability was reported in Microsoft Internet Explorer in the processing of shortcuts via scripting code. A remote user can create HTML that, when loaded by a target user, will execute arbitrary code.

It is reported that if active scripting is enabled, the 'Shell.Application' ActiveX object can be used to modify a known shortcut ('.lnk' file) and then execute the modified shortcut. The report indicates that the shell link (i.e., shortcut) can invoke 'mshta.exe' to execute arbitrary HTA code located at a remote site. The Microsoft HTML Application Host process (mshta.exe) will reportedly execute the remote HTA code on the target system. A demonstration exploit HTA file that will apparently create an executable on the target system is provided at:

http://www.malware.com/poopware.hta

A demonstration HTML file that will trigger the flaw is available at:

http://www.malware.com/exe-cute-html.zip

Impact:   A remote user can execute arbitrary code on the target user's system with the privileges of the target user when the target user views an HTML file.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.microsoft.com/technet/security/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-Disclosure] Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part IV




Thursday, January 01, 2004 


The following file is an html file comprising both scripting and 
an executable [*.exe]. 

We inject scripting and an executable into the html file which 
is designed to point back to the executable in the html file and 
execute it. Provided the html file is an html file, Internet 
Explorer 5.5 and 6.0 will execute it. 

Because it is an html file proper, Internet Explorer opens it. 
The scripting inside is then parsed and fired. That scripting is 
pointing  back to the same executable file and because it is a 
self-executing html file, it executes ! 


Fully self-contained harmless *.exe: 

http://www.malware.com/exe-cute-html.zip

Be aware of html files out there.


-- 
http://www.malware.com



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC