Unpatched IE Flaw Extremely Critical

Durinthal writes "The biggest blip on the security radar over the Thanksgiving holiday was the realization by the security community that an Internet Explorer problem first identified six months ago was a lot worse than it appeared, as what appeared to be only a DoS vulnerability also allows for execution of arbitrary code. The realization caused Secunia to issue a rare 'Extremely Critical' advisory."

Comments

Proof of Concept

[Motherfucking Shit]

Here is a link to the Proof of Concept page, which will launch an instance of calc.exe if you're vulnerable. AVG Free caught the exploit in the cached page, but calc.exe ran anyway, even after I deleted the file.

Re:Proof of Concept

[Sawbones]

Oddly enough it didn't work for me. IE 6 on a windows machine, it spawned a small dialog window and then a javascript "prompt" box with what I would assume was unicode characters. But after that it just sat there. not crashing nor using a tremendous amount of resources. I would assume that the exploit doesn't require a user to click buttons since the advisory mentioned "just visiting a webpage". So what "should have" happened?

Re:Proof of Concept

[Pxtl]

Hm. I get a "Script Prompt" window over a tiny IE window, with the name of your site in a textbox. A few seconds later (or when I touch it) it snaps and then I get the windows "close-details" app crash window.

So it disturbs the browser, but it doesn't hack it for me.

Re:Proof of Concept

[TheSpoom]

Slightly offtopic, but if you're wondering, NAV calls anything it considers suspicious enough to stop but doesn't have a name for yet "Bloodhound" because that's the component that detects buffer overflows and the like. Just something rather interesting I found when I was doing tech support.

Re:Proof of Concept

[TheSpoom]

Proof of concept crashed (or at least, froze to the point of me having to kill the process) my Firefox, but did not open calc.exe. So technically, it could be used as a DoS attack on other browsers as well, though not nearly as badly as on IE.

Re:Proof of Concept

[PlusFiveTroll]

Firefox didnt crash, if you waited long enough (like I did) it opens up a popup dialog full of ??????'s, you can then close the window. But it did take a full 3 minutes on a Athlon64 300+ with a gig of ram. calc.exe does not run.

Re:Proof of Concept

[Hrungnir]

Odd, My Symantec Antivirus didn't catch it. launced calc and IE closed.

Opera just opens another little window with nothing in it, doesn't open calc or show any odd behavior

Re:Proof of Concept

[jpop32]

So technically, it could be used as a DoS attack on other browsers as well, though not nearly as badly as on IE.

Well, Opera just opened a small window which just sat there and did nothing. I closed it, and continued on my merry way. Score one for Opera. :-)

Temp Fix

[Manip]

Turn on "Data Execution Protection" for all programs and services. Instead of allowing full execution it will limit it to a DOS (crack IE).

Control Panel -> System -> Advanced [Tab] -> Performance Settings -> Data Execution Protection [Tab] -> Turn on DEP for all programs and services except those I select -> Ok -> OK.

Re:Temp Fix

[_Shorty-dammit]

I believe DEP is on by default for IE anyways, so I'm not sure this is even necessary. I just tried the proof-of-concept test on my machine, and all it did was bring up some script prompt, didn't launch calc.exe as it should have. This is with the IE7 beta, btw.

Re:Temp Fix

[Ron Bennett]

Turned DEP on, shutdown/restarted, and still no good - the exploit (calculator comes up) still works :(

Perhaps hardware based DEP would make a difference, but again, for folks relying on software-based DEP, it's not effective - the exploit still works anyways.

Ron

It affects Firefox, too.

[Mitchell Mebane]

Although it's not as severe.

https://bugzilla.mozilla.org/show_bug.cgi?id=31733 4

Re:Scummy eweek popup alert

[BattleRat]

The extention you are looking for is called NoScript. It works awesome.

Re:Scummy eweek popup alert

[HoosierPeschke]

Try this NoScript. It's a whitelist so you can allow only certain sites to use javascript.

McAfee Fails It

[Orrin Bloquy]

On my W2K box, McAfee warns me of a threat, then as soon as I close the window, the code executes anyway.

McAfee Catches it

[borawjm]

My virus scanner seemed to stop it on the proof of concept page. McAfee sees it as JS/Exploit-BO.gen

Please stop accepting stories from Spammers

[Billly Gates]

His name points to an url and he is trying to use slashdot to boast his google pagemark. Move the cursor over the name? His site pops right up.

  Just yesterday a famous spammer did the same thing and posted here. The slashdot editors should stop accepting such stories that are fabricated in order to boast his advertising revenue.

Re:Am I the only one?

[m50d]

Anyone else could be doing it. The fact that they're nice enough to give you a link rather than just doing it suggests they're not out to get you.

Simmer down

[TubeSteak]

The URL is http://www.ocremix.org/
And here's the submitter's user page http://slashdot.org/~Durinthal

I think you mistook the submitter for **Beatles-Beatles
This Beatles guy is really getting out of hand.
He manages to taint stories he isn't even submitting. ...or maybe /.'ers need to stop being so effing hyper sensitive about certain things.

Re:Scummy eweek popup alert

[NickFitz]

IIRC, the JavaScript confirm() function returns three values -- true, false, or null, depending on whether you hit ok, cancel, or x.

Unfortunately not. I can see that it would be useful to have, but a quick test shows that both Cancel and the Close button return false (on Windows 2000, IE 6 and Firefox 1.0.7). IIRC this is in line with the expected behaviour for such dialogs, although that may vary per operating system.

Try it: type

javascript:alert(confirm("blah"))

in your browser location bar.

For the paranoid/justifiably cautious: the "javascript:" causes the browser to pass the rest of the line to the JS interpreter, "alert(expr1)" pops up an alert (surprise!) containing the string value of expr1, and "confirm(expr2)" does the OK/Cancel box containing the string value of expr2. So first you get the OK/Cancel box, which returns a boolean value, which is then converted to a string, which is displayed in the alert box.

Re:Extremely Dupical

[Anonymous Coward]

OK, now I know Slashdot's biased, but posting this twice and not posting this at all?

All your OS are belong to Sun!

Re:Firefox vulnerable too

[FooAtWFU]

It doesn't crash firefox. It hangs Firefox because it's trying to display a prompt() wherein it must reflow zillions of interesting Unicode characters. Eventually it'll display.

if you interrupt the busy state in a debugger we're busy in layout trying to
display the prompt(). Usually in some form of Reflow(), sometimes in font
stuff, sometimes in Bidi (nsBidiPresUtils::RemoveBidiContinuation?).

The bugzilla title for this bug is 'hang when long wrappable string is passed to prompt()'.

Re:Firefox v1.5

[m0i]

This makes Slashdot exactly on the day Firefox v1.5 is supposed to be released. Apparently, Mozilla want to create a huge marketing campaign, better and larger than the one for v1.0. This is a perfect time to capitalize on this horrible security hole to promote Firefox.

Hrm, did you notice that Firefox 1.5 is crashing as well on this exploit? It's not a security risk but a big annoyance nonetheless.

Actually...

[Anonymous Coward]

Yes it has. The vulnerability was found by me, Paul from Greyhats Security, and disclosed responsibly to Mozilla. However, a mistrusted individual leaked the vulnerability details, which quickly made their way to security websites. Secunia rated the flaw as Extremely Critical, but later dropped the rating to Highly Critical due to that fact that Mozilla changed their servers in order to render the proof of concept ineffective, even though the core vulnerability was still in the browser, and in theory could have been updated to work again.

The bug details can be found either at Secunia or at my site. The URLs for the advisory are posted below.
Secunia: http://secunia.com/advisories/15292/
Greyhats Security: http://greyhatsecurity.org/firefox.htm

Just wanted to clarify that for you :)