[NT] Internet Explorer Multiple Download Dialog Vulnerabilities (MS05-054)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Internet Explorer Multiple Download Dialog Vulnerabilities (MS05-054)
------------------------------------------------------------------------


SUMMARY

A vulnerability in Internet Explorer can be exploited by malicious people
to trick users into executing arbitrary programs on a user's system.

DETAILS

Vulnerable Systems:
* Microsoft Windows 2000 Service Pack 4
* Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service
Pack 2
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service
Pack 1
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft
Windows Server 2003 with Service Pack 1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition family
* Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and
Microsoft Windows Millennium Edition (ME) Review the FAQ section of this
bulletin for details about these operating systems.
* Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service
Pack 4
* Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service
Pack 4 or on Microsoft Windows XP Service Pack 1
* Internet Explorer 6 for Microsoft Windows XP Service Pack 2
* Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft
Windows Server 2003 Service Pack 1
* Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based
Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based
Systems
* Iternet Explorer 6 for Microsoft Windows Server 2003 x64 Edition
* Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition
* Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium
Edition Review the FAQ section of this bulletin for details about this
version.
* Internet Explorer 6 Service Pack 1 on Microsoft Windows 98, on
Microsoft Windows 98 SE, or on Microsoft Windows Millennium Edition
Review the FAQ section of this bulletin for details about this version.

Download Dialog:
A design error in the processing of mouse clicks in new browser windows
and the predictability of the position of the "File Download" dialog box
can be exploited to trick the user into clicking on the "Run" button of
the dialog box. This is exploited by first causing a "File Download"
dialog box to be displayed underneath a new browser window, and then
tricking the user into double-clicking within a specific area in the new
window. This will result in an unintended click of the "Run" button in the
hidden "File Download" dialog box.

Keyboard Shortcut Processing:
The vulnerability is caused due to a design error in the processing of
keyboard shortcuts for certain security dialogs. This can e.g. be
exploited to delay the file download dialog and trick users into
executing a malicious ".bat" file after pressing the "r" key.

A successful attack may be outlined as:
1. Detect that the user is typing on the keyboard.
2. Redirect to a malicious ".bat" file.
3. In a new thread, force the browser to consume a large amount of CPU
resources via a simple loop statement. This causes the upcoming file
download dialog to be delayed.
4. The user eventually presses the "r" key which is a keyboard shortcut
for opening the downloaded file. The download dialog has not yet been
shown for the user when this event occurs.
5. The loop statement stops causing the download dialog to be visible and
the keyboard shortcut event is processed.
6. The malicious ".bat" file is launched.

The vulnerability has been confirmed on a fully patched system with
Internet Explorer 6.0 and Microsoft Windows XP SP2.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2829>
CAN-2005-2829

Disclosure Timeline:
21/05/2005 - Keyboard Shortcut Processing Vulnerability was discovered
24/05/2005 - Vendor notified
20/06/2005 - Vendor confirms the vulnerability
26/06/2005 - Vulnerability about File download dialog was discovered and
reported to vendor
13/12/2005 - Vendor issues patch for Keyboard Shortcut Processing
Vulnerability
13/12/2005 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by <mailto:vuln@xxxxxxxxxxx> Secunia
Research.
The original article can be found at:
<http://secunia.com/secunia_research/2005-21/advisory/>
http://secunia.com/secunia_research/2005-21/advisory/,
<http://secunia.com/secunia_research/2005-7/advisory/>
http://secunia.com/secunia_research/2005-7/advisory/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages