CERT-In Advisory
CIAD-2004-0012
Internet Explorer Local Resource Access and Cross-Zone Scripting Vulnerabilities
Original Issue Date: June 10, 2004
Updated: July 31, 2004
Severity Rating: High
Systems Affected
Microsoft Windows systems running
- Internet Explorer 6.0
- Internet Explorer 6.0 SP1
Overview
Two vulnerabilities have been reported in Internet Explorer, which in combination with other known issues can be exploited by malicious users to compromise a user's system.
Impact
There are reports that exploits for these vulnerabilities are easily available on the Internet. Successful exploitation of these vulnerabilities results in access to local resources on a victim's system and execution of arbitrary code in the context of the local user.
The vulnerabilities are actively being exploited on the wild to install adware on users' systems.
Description
The two vulnerabilities being exploited by the malicious users are 1. Microsoft Internet Explorer URL Local Resource Access Weakness The vulnerability in IE may allow unauthorized access to local resources on a users's system. B y crafting a malicious URL , an attacker may access a file on a vulnerable system by pre-pending "URL:" to a request for a specific resource, e.g. URL:ms-its:C:\WINDOWS\Help\iexplore.chm::/iegetsrt.htm
2. Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability
This vulnerability in IE may permit cross-zone access, allowing an attacker to execute malicious script code in the context of the Local Zone. It is possible to exploit this issue by passing a dynamically created IFrame to a modal dialog. It may also be possible to exploit this vulnerability to access properties of a foreign domain, allowing for other types of attacks that compromise sensitive or private information associated with a domain of the attacker's choosing. For exploiting these vulnerabilities users are enticed to follow a link or view a malicious HTML document. According to Security Focus , t hese vulnerability could be exploited in combination with a number of other security issues, such as Multiple Microsoft Internet Explorer Script Execution Vulnerabilities. Secunia has confirmed the vulnerabilities in a fully patched system with Internet Explorer 6.0. It has been reported that the preliminary SP2 prevents exploitation by denying access.
Solution
Apply appropriate patches as mentioned in the Microsoft Security Bulletin
MS04-025.
Workaround
Support for active scripting should be disabled for all but trusted web sites.
References
Security Focus Vulns Info ' Microsoft Internet Explorer URL Local Resource Access Weakness '
http://www.securityfocus.com/bid/10472/
Security Focus Vulns Info ' Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability'
http://www.securityfocus.com/bid/10473/
Security Focus Vulns Info ' Multiple Microsoft Internet Explorer Script Execution Vulnerabilities'
http://www.securityfocus.com/bid/8577
Secunia Advisory SA11793
http://secunia.com/advisories/11793/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|