Posted on 01/28/2004 1:10:12 PM PST by Salo
New Explorer hole could be devastating Browser users could be fooled into downloading executable files
By Kieren McCarthy, Techworld.com January 28, 2004
A security hole in Microsoft Corp.’s Internet Explorer could prove devastating. Following the exposure of a vulnerability in Windows XP earlier this week, “http-equiv” of Malware has revealed that Explorer 6 users (and possibly users of earlier versions) could be fooled into downloading what look like safe files but are in fact whatever the author wishes them to be -- including executables.
A demonstration of the hole is currently on security company Secunia’s website and demonstrates that if you click on a link, and select “Open” it purports to be downloading a pdf file whereas in fact it is an HTML executable file.
It is therefore only a matter of imagination in getting people to freely download what could be an extremely dangerous worm -- like, for instance, the Doom worm currently reeking havoc across the globe.
However what is more worrying is that this hole could easily be combined with another Explorer spoofing problem discovered in December.
The previous spoofing problem allowed Explorer users to think they were visiting one site when in fact they were visiting somewhere entirely different. The implications are not only troublesome, but Microsoft’s failure to include a fix for the problem in its January patches has led many to believe it cannot be prevented.
If the same is true for this spoofing issue, then it will only be a matter of time before someone who thinks they are visiting one website and downloading one file will in fact be visiting somewhere entirely different and downloading whatever that site’s owner decides.
We also have reason to believe there is no fix. It may be that today’s flaw is identical to one found nearly three years ago by Georgi Guninski in which double-clicking a link in Explorer led you to believe you were downloading a text file but were in fact downloading a .hta file.
In both cases, the con is created by embedding a CLSID into a file name. CLSID is a long numerical string that relates to a particular COM (Component Object Model) object. COM objects are what Microsoft uses to build applications on the Internet. By doing so, any type of file can be made to look like a “trusted” file type i.e. text or pdf.
Guninski informed Microsoft in April 2001. The fact that the issue has been born afresh suggests rather heavily that the software giant has no way of preventing this from happening.
So how bad could it get? Just off the top of our heads -- suppose someone set up a fake Hutton Inquiry site today with a link to the report’s summaries -- how many people across the U.K. would download a worm this afternoon? And imagine the computers it would end up on.
The possibilities are endless, and since both spoof issues appear to be unfixable, it must surely place a big question mark over Explorer’s viability as a browser.
The advice is to avoid this latest hole is always save files to a folder and then look at them. On your hard drive, the file’s true nature is revealed. But this advice is nearly as practical as Microsoft telling users not to click on links to avoid being caught out by the previous spoof problem.
All in all, it does not look good. Not good at all.
So you think this stuff is funny, huh.
A comparison of Marxist Communism and the Open Source Software movement
(written by a communist)
A comparison of Marxist Communism and the Open Source Software ...
Once again, proof that humor is lost on the dense.
Go peddle your tripe at SCO.
You have no room to complain, Pinkboy. Your oh-so-hallowed Microsoft gave Red China the canonical "keys to the kingdom" by forking over its threat-to-national-security-if-seen-by-human-eyes source code.
Must be nice defending an outfit comprised of liars and traitors.
At least I'm not one. Out.
Six?
At least I'm not one.
By supporting them, you are one of them.
Memo to self: must refrain from posting on OS War Threads... have been succesful for many months.... oh, what the hey...
To Aruanan:
ROTFL!
Must be nice defending an outfit comprised of liars and traitors.
At least I'm not one. Out.
Sure, there are plenty of people that buy American first. The fact you scoff at it is sickening.
You are so transparent it is funny to watch you twist. Here, you're seriously claiming that you'd actually recommend a window manager like CDE to someone when there are other products available and distributed by the same vendor (Sun in this case), that are vastly superior in order to satisfy your 'buy america' urge despite it being against what would be the best interests of your supposed 'clients'. Come to think of it, it sounds a lot like the rest of the garbage you are peddling with your microsoft song and dance. It's pitiful, really, that you would actually take money from people who are paying for your recommendation when you are doing nothing but pushing a political agenda under the guise of providing technical support assistance or advise.
This, more than anything else convinces me that you do not, in fact, have any clients of this kind other than friends that you are able to bullsh!t into believing that you have a clue at all of what you are talking about. Nope. I pegged you correctly after all. What nick do you go by while astroturfing DU?
I hear basically the same sentiment around here for people who don't do basic things to lock down their Windows systems. This just raises the bar from individual flaws to the whole OS.
If you are a user of Internet Explorer, you should probably do something about that, like get Firebird or Mozilla or Opera. Remember, the sooner you give in to godless communism and cut the pins out from under Microsoft, the sooner they'll have to stop sending people into Internet forums to sidetrack the threads that they don't like. |
<a href="http://www.microsoft.com%00@secunia.com/internet_explorer_address_bar_spoofing_test/" style="font: 8pt verdana, sans-serif;"> Click Here to Perform Test! </a>
Show me an example of this actually doing anything.
Are you sure about this? Can ActiveX access environment variables? If so, then it will know %USERPROFILE% or %USERNAME%, and be able to access the file.
Mark
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.
We interrupt this blatant sidetracking about linux and communism to remind our audience that the "devastating" hole in Internet Explorer still exists, even if Microsoft's public relations contractors would prefer that you talk about something else.