SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Microsoft Internet Explorer Vendors:   Microsoft
(Exploit Code Has Been Released) Microsoft Internet Explorer Buffer Overflow in IFRAME/EMBED Tag Processing Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1012049
SecurityTracker URL:  http://securitytracker.com/id/1012049
CVE Reference:   CVE-2004-1050   (Links to External Site)
Updated:  Dec 1 2004
Original Entry Date:  Nov 2 2004
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 6
Description:   A buffer overflow vulnerability was reported in Microsoft Internet Explorer (IE) in the processing of IFRAME and EMBED tags. A remote user can execute arbitrary code on the target user's system.

ned from felinemenace.org and Berend-Jan Wever and others reported that IE does not properly validate certain IFRAME and EMBED tag attributes. A remote user can create specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.

A specially crafted SRC and NAME attribute can trigger the flaw, allowing the HTML to modify the EAX register, which can lead to modification of the ECX and subsequently the EIP register. A demonstration exploit is of the following form:

<IFRAME SRC=AAAAAAAAAAAA.... NAME="BBBBBBBBBBB....">

Exploit code has been released.

It is reported that systems running Windows XP SP2 are not affected.

Impact:   A remote user can execute arbitrary code on the target user's system with the privileges of the target user.
Solution:   No solution was available at the time of this entry.

It has been reported that Windows XP SP2 is not affected.

Vendor URL:  www.microsoft.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)
Underlying OS Comments:  All versions except XP SP2

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 9 2004 (Viruses Are Exploiting This Flaw) Microsoft Internet Explorer Buffer Overflow in IFRAME/EMBED Tag Processing Lets Remote Users Execute Arbitrary Code
Viruses are actively exploiting this vulnerability.
Dec 1 2004 (Vendor Issues Fix) Microsoft Internet Explorer Buffer Overflow in IFRAME/EMBED Tag Processing Lets Remote Users Execute Arbitrary Code
The vendor has issued a fix.



 Source Message Contents

Subject:  Re: [Full-Disclosure] python does mangleme (with IE bugs!)


Hi all, here's my analysis of these bugs:

2445.html does nothing on my win2ksp4en/ie6.0sp1. (IE does crash when you load it because the META refresh tag leads to 2446.html.)
2446.html contains an exploitable BoF in the IFRAME tag using the SRC and NAME property. To trigger the BoF you only need this tag
 in a HTML file:
<IFRAME SRC=AAAAAAAAAAAA.... NAME="BBBBBBBBBBB....">

Exactly why or how it happens, I do not know yet. I do know you can control EAX, after which this gets executed:
7178EC02                      8B08            MOV     ECX, DWORD PTR [EAX]
7178EC04                      68 847B7071     PUSH    SHDOCVW.71707B84
7178EC09                      50              PUSH    EAX
7178EC0A                      FF11            CALL    NEAR DWORD PTR [ECX]
Control over EAX leads to control over ECX, which you can use to control EIP: Remote Command Execution.

They'd better patch this one quickly, a reliable working exploit shouldn't take more then a day to code.

Cheers,
SkyLined

----- Original Message ----- 
From: "ned" <nd@felinemenace.org>
To: <bugtraq@securityfocus.com>
Cc: <full-disclosure@lists.netsys.com>; <lcamtuf@ghettot.org>
Sent: Sunday, October 24, 2004 06:36
Subject: [Full-Disclosure] python does mangleme (with IE bugs!)


> i've made a port of mangleme:
> http://felinemenace.org/~nd/htmler.py
> with a few extra quirks (such as file extentions/url types)
> 
> it finds IE bugs after roughly 2.5 -> 3 hours and they are at:
> http://felinemenace.org/~nd/crash_ie/
> 
> They are not the null pointer dereference that Michal found (which 
> curiously seems to not own my 6.0.2800.1106.xpsp1?) but some other 
> probably non-exploitable problems!
> 
> htmler.py doesn't use CGI like mangleme but generates webpages in the 
> directory 'html1' numbered 0.html to n.html. 0.html then uses a refresh to 
> load 1.html and so on with little user interaction required!
> 
> anyway, if you find bugs with it, don't sell to anyone/notify vendors!
> - nd
> 
> -- 
> http://felinemenace.org/~nd - "eat a duck"
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC