Re: [Full-disclosure] [scip_Advisory 1746] Microsoft Internet Explorer 6.0 embedded content cross site scripting

From: Brion Vibber (brion_at_pobox.com)
Date: 09/22/05

  • Next message: Secunia Research: "Secunia Research: PowerArchiver ACE/ARJ Archive Handling Buffer Overflow" 
    Date: Thu, 22 Sep 2005 14:56:05 -0700
To: Marc Ruef <maru@scip.ch>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Marc Ruef wrote:
    | III. EXPLOITATION
    |
    | The following proof-of-concept has been published in the articles "Wie
    | mit GIF-Bildern Cross Site Scripting-Angriffe im Internet Explorer
    | umgesetzt werden können" in scip monthly Security Summary Issue 19.
    | September 2005 (pp. 12-14)[1] and "GIF-Bug im Internet Explorer 6 -
    | Proof of Concept" at computec.ch[2]:
    |
    | 01 <GIF89aź 8 ÷™f˙™™>

    The reason that this works in this case is that this is *not* a GIF
    header; GIF headers do not begin with "<". It is well known that IE will
    interpret files as HTML that contain certain HTML tags if a another type
    detection doesn't override it.

    For Microsoft's vague documentation on this process, see:
    http://msdn.microsoft.com/workshop/networking/moniker/overview/appendix_a.asp

    If you remove the "<" at the beginning, then IE will detect the GIF
    signature, overriding its HTML detection, and show a 'broken image' icon
    with no interpretation of JavaScript.

    (Tested MSIE 6.0.2900.2180.xpsp_sp2)

    However the advice is good; as a general rule sites accepting uploads
    should validate them as carefully as possible, as IE may not recognize
    all file types properly. Invalid image file headers and HTML-like tags
    near the start of a file should be considered suspicious.

    - -- brion vibber (brion @ pobox.com)
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (Darwin)
    Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

    iD8DBQFDMyh1wRnhpk1wk44RAtoDAJ9QIJbNMXro7z3pFCzXuOy1Oz10gACfZxTd
    OSITbHzoYn+T8Ozq0d6ZfQ4=
    =Gm+c
    -----END PGP SIGNATURE-----

  • Next message: Secunia Research: "Secunia Research: PowerArchiver ACE/ARJ Archive Handling Buffer Overflow"
    • Quantcast