What A Drag! -revisited-

From: mikx (mikx_at_mikx.de)
Date: 08/24/04

  • Next message: Jérôme: "WebAPP directory traversal and ability to retrieve the DES encrypted password hash"
    To: <bugtraq@securityfocus.com>
    Date: Tue, 24 Aug 2004 13:24:00 +0200
    
    

    Most people i talked to consider the Internet Explorer drag and drop
    vulnerability found by http-equiv not as a serious problem, because it
    requires some user interaction and the press pushes this topic way to much
    as the "first security problem in SP2". In an article on BetaNews even
    Microsoft claims it's not a high risk for customers
    (http://www.betanews.com/article/1093035994).

    To proof it's not a "hype" created by the media or companies like secunia, i
    created another proof-of-concept based on http-equiv's code that hides both
    the image to drag and the local folder you drop it to. As a result using the
    window scrollbar will install malware in your startup folder.

    A little 5x5 pixel "drop zone" will automaticly follow your mouse. Just drag
    the window scrollbar as usual (and a hidden image at the same moment) and
    whereever you release the mouse button you will drop an exe file to your
    shell:startup (as long as you remain inside the browser window of course).

    Demo website: http://www.mikx.de/scrollbar/

    Dragging the window scrollbar is a common behavior - even if i can't believe
    there was a world before mouse wheels. A common user will probably don't
    recognize the installation at all.

    Speaking of behaviors: If service pack 2 is installed you can work around
    this vulnerability by disabling "binary behaviors" in the new IE activex
    settings. You don't need to disable scripting completely.

    It took me only 20 minutes to create this, so script kids around the world
    with enough free time will create even better protected mechanisms to
    exploit this bug in the near future.

    Take it serious!

    mikx


  • Next message: Jérôme: "WebAPP directory traversal and ability to retrieve the DES encrypted password hash"

    Relevant Pages

    • What A Drag! -revisited-
      ... Most people i talked to consider the Internet Explorer drag and drop ... requires some user interaction and the press pushes this topic way to much ... window scrollbar will install malware in your startup folder. ... this vulnerability by disabling "binary behaviors" in the new IE activex ...
      (NT-Bugtraq)
    • [Full-Disclosure] What A Drag! -revisited-
      ... Most people i talked to consider the drag and drop vulnerability found by ... window scrollbar will install malware in your startup folder. ... Speaking of behaviors: If service pack 2 is installed you can work around ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] Virus loading through ActiveX-Exploit [Fwd: George Bush sniper-rifle shot!]
      ... drag and drop file installation vulnerability discovered by http-equiv. ... When the user clicks on the image, the underlying popup window is moved ... Another trick that they use is to download the payload executable first, ...
      (Full-Disclosure)