New Explorer hole could be devastating

Infoworld ^ | 01/28/04 | Kieren McCarthy

[justlurking]

The ActiveX control does not know the absolute path to "C:\Documents and Settings\[USER]\Local Settings\Temp" because it lacks knowledge of who the "[USER]" is.

It appears to work fine on my Windows XP laptop.

[Bush2000]

That's interesting. Does it run as a different user?

No, the attack just hardcodes the path to "C:\WINDOWS\TEMP\foobar.exe" and runs within the context of the current user.

[Outlaw76]

I've been using Firebird for about two weeks now. I love the tabbed browser windows. I don't see me going back to exlorer any time soon.

[Bush2000]

It appears to work fine on my Windows XP laptop.

You're either lying -- or you're tuning the sample to your config. There's no way that it can run an executable from C:\WINDOWS\TEMP under XP when the exe will be downloaded to C:\DOCUMENTS AND SETTINGS\[USER]\Local Settings\Temp

[Salo]

So if you are running as an admin, as most home machines do, you could be in for a world of hurt?

[djf]

Yup. Been using Firebird for about 3 months now, and got the Thunderbird mail client too. Best browser I've ever used.

[justlurking]

You're either lying -- or you're tuning the sample to your config.

I'm doing neither. I'm simply running the demo:

http://secunia.com/Internet_Explorer_File_Download_Extension_Spoofing_Test/

If I understand it correctly, they are claiming that you can be led to believe you are opening an PDF file, instead of something else.

The demo actually opens an HTML file. But, it could just as easily be an executable. If I can figure out all the details, I'll create a better demo.

BTW, Mozilla Firebird will do something similar, with one exception: it will tell you that you are opening an HTML file, rather than a PDF file. Since Firebird will warn you separately about opening an executable file, the protection is a little better, but not foolproof for people that open attachments in email from unknown senders.

[sigSEGV]

Microsoft gave up on properly supporting IE months ago.

http://www.safecenter.net/UMBRELLAWEBV4/ie_unpatched/index.html

[antiRepublicrat]

First MyDoom and then this. Not a good start to the year for Microsoft. And they still haven't fixed the flaw found in December, which can be used in conjunction with this.

Oh, I figured it out. MS wanted to have that patch-free month, so they just decided not to release patches for known security flaws.

[justlurking]

A bit of additional info: the Adobe Acrobat plugin is usually launched immediately when one clicks on a PDF link.

However, this exploit prompts you for the download, which is unusual behavior if you recognize it. The issue seems to be the ability to obscure the true type of the file being downloaded.

[adam_az]

You're either lying -- or you're tuning the sample to your config. There's no way that it can run an executable from C:\WINDOWS\TEMP under XP when the exe will be downloaded to C:\DOCUMENTS AND SETTINGS\[USER]\Local Settings\Temp

BUSH LIED!!!

No, not the President, just the uneducated pretender who uses his name. ;)

It could always just point to c:\Documents and Settings\%username%\

Type that into your browser if you don't believe me, or from a dos promt, type
c: (if you aren't already on the c: disk)
cd \Documents and Settings\%username%\

Ever hear of an ENVIRONMENT VARIABLE, Bushie? You are farm league, yet you feign skillz.

[adam_az]

Just another example of Bush 2000's technical skills being purely bush league, aka all bushed out.

[RS]

".....demonstrates that if you click on a link, and select “Open” ....."

If you click on a link and select "open" your computer should kick your butt - and then go out and kick the butt of the fool who put the "open" button there in the first place.

[justlurking]

BUSH LIED!!!

No, he didn't lie. He just made an error. Given the vague description of the exploit, it's not reasonable to expect everyone to interpret it correctly.

However, when given an opportunity to correct his mistake, he instead escalated to an accusation of fabrication.

[AdmSmith]

Use another browser, such as Opera at http://www.opera.com

[Principled]

Firebird flag.

I think I'll try it. How big is it?

[mhking]

I think I'll try it. How big is it?

The entire folder, once installed is somewhere around 13MB, so it's not too big...

[Principled]

So mhking recommends i to principled?

Is it Red Hat or some such?

[Principled]

i=it

and Mozilla... who does Mozilla?

[Prime Choice]

I have no worries...