|
|
| |
Microsoft Internet Explorer is "since many years the most popular web browser. The main reason for this popularity is the default use in the latest releases of the Microsoft Windows operating system series".
Sven Vetsch found a cross site scripting vulnerability in the current releases of Microsoft Internet Explorer. Thus, it is possible to use a manipulated embedded content to run arbitrary script code in the security context of the website. |
| |
Credit:
The information has been provided by Marc Ruef.
The original article can be found at: http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1746
|
| |
The problem lies in the handling of the content of such files (e.g. a picture). In the first place the usual file header (e.g. for GIF files) is provided - The remaining content of the file could be usual html data. Therefore embedding script code in the latter may be possible. This injected code is executed by the HTML rendering engine of the web browser. In the proof-of-concept by Sven Vetsch and the examples of scip AG a GIF file is used (see chapter III). But it seems other files that could be embedded in an html file could be used too (e.g. JPG, WAV, AVI, RM/RAM).
It seems that the Internet Explorer is putting all the data (HTML frame and embedded content) into one stream. Afterwards this one is put thru the rendering engine. This is not able to determine the real beginning and end of an embedded file. Content of those - not expected in any way - is handled as HTML code too.
More details are available at the scip vulnerability Database at http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1746 (german only).
Exploitation:
The following proof-of-concept has been published in the articles "Wie mit GIF-Bildern Cross Site Scripting-Angriffe im Internet Explorer umgesetzt werden k nnen" in scip monthly Security Summary Issue 19. September 2005 (pp. 12-14)[1] and "GIF-Bug im Internet Explorer 6 - Proof of Concept" at computec.ch[2]:
01 <GIF89a 8 f >
02 <html>
03 <head>
04 <script>
05 alert("XSS");
06 </script>
07 </head>
08 <body>
09 </body>
10 </html>
As you can see in the line 01 the usual GIF89a header is given. But the following lines (02-10) come with common HTML and script code.
Successfull exploitation requires streaming the content (e.g. the web site and the corrupted embedded content) from a web server over HTTP or HTTPS. Running the exploit locally is not possible because the handling of the data seems not to be the same.
Impact:
This seems to be a major problem. All web sites that allow the upload of files to use in further use are affected. For instance auction web sites as like eBay with a corrupted picture of the sell item or all board pages with the functionality of an avatar upload.
Detection:
An attack attempt is not easy to detect. Content screening may be able to detect suspicous strings as like <script>. See chapter VI for more details and counter-measures.
Workaround:
End users should change to another web browser engine that is not affected by this vulnerability. Successfull testings have been made with free browsers as like Mozilla Firefox up to 1.0.5, Netscape up to 8.0 and Opera. All of them are not affected.
Web masters have to possibilities of preventing misuse of their systems:
(1) They could de-activate all upload and embedding (e.g. BBcode or HTML code) in their web site.
(2) The other solution would be a content check of untrusted files if they include scripting or html code. Strings as like <script> should raise the alarm and let the data throw away. Regulary expression as used in classical input validation of web applications can be applied here too.
Vendor Response:
Microsoft has been informed in an early stage of elevation (see chapter IX) at 07/31/05. There were no real verification of the threat and danger in the response mail at 01/08/05.
We expect the vendor is addressing the issue with an emergency patch the next few weeks/months. Tipp: Visit http://windowsupdate.microsoft.com on a regulary base.
Disclosure Timeline:
07/15/05 Sven Vetsch detects the flaw
07/28/05 Discussion between Sven Vetsch and scip AG how to disclose the information
07/31/05 Sven Vetschs informs Microsoft
08/08/05 Semi-automated response by Microsoft
09/19/05 scip AG informes their registered Pallas and SMS customers
09/19/05 Proof-of-concept published at computec.ch
09/19/05 Full article published in scip monthly Security Summary
09/22/05 Public advisory
|
| Subject:
|
Cant replicate ... |
Date: |
30 Oct. 2005 |
| From: |
alphakgengmail.com |
| I am unable to replicate this PoC ... Maybe a ready gif file ? |
|
| Subject:
|
Yet another reason to use Firefox |
Date: |
10 Nov. 2005 |
| From: |
Capital T |
Does anybody need more reasons to use Firefox?
Browse this site and you'll find enough reasons to be a Firefox user (or even developer). |
|
| Subject:
|
Too Old Too Present Too Dummy |
Date: |
5 Feb. 2007 |
| From: |
Oscar Duron |
FireFox is open source and compiled by any,... How can you think of a solution at the browser side, if any hacker can make a custom behaviour browser?
Be real ... computers are unregulated toys resembling real atomic bombs.
Finally there will be only two kind of users, the predators and the antipredators. Choose yor side.
|
|
|
|
|
