|
COMMAND Internet Explorer security zone bypassed SYSTEMS AFFECTED Internet Explorer 6.0, 5.5, 5.01 PROBLEM Andreas Sandblad [sandblad@acc.umu.se] reported : In order for IE to parse a local file as a html document the filename extension must be associated with html documents (normally .htm and .html). Also the file cannot be binary. This is good security because several types of userdata is stored in local files (cookies, favorites/bookmarks, application userdata etc). The problem is that IE can be tricked into thinking that any non binary local file is a html document. ::: ATTACK ::: The Cookie attack: A cookie containing html code is set on the user\'s system. Using the trick we can make IE loading the cookie file as a html document. Once loaded it will operate in the local zone. The favorite/bookmark attack: Assume an user accept to add a favorite/bookmark. If we placed html code in the favorite\'s url, we can then load the favorite file in the same way as in the cookie attack. The file will be operating in the local zone. Winamp attack (if Winamp is installed): Winamp stores current playlist in \"c:/program files/winamp/winamp.m3u\". The playlist will contain artist name and song title. If we inject html code in the artist/title of a mp3 file that is loaded remotely, the new playlist file will be saved together with html code. Using the trick the local playlist file can be loaded and operate in the local zone. Since the playlist file will contain the exact path to the \"temporarily internet folder\", we can using the old \".chm helpfile attack\" run arbitrary code. SOLUTION Microsoft released a patch 28 march, \"Microsoft Security Bulletin MS02-015\" -However- The patch released by Microsoft doesn\'t adress the actual problem, because it simply disallow local files in the cookie directory to script in the local zone. It doesn\'t take care of the issue that IE can be tricked to parse any non binary file as html document.