Re: Spyware/Virus

From: Kent W. England [MVP] (kwe_at_mvps.org)
Date: 09/14/04

  • Next message: suny: "memory is full" 
    Date: Mon, 13 Sep 2004 22:17:58 -0700

    MAP wrote on 12-Sep-2004 10:53 PM:

    > Hi Kent,What is the drag&drop vulnerability?

    The Drag&Drop vulnerability is also known as the Shell Handler
    vulnerability and is a variant of Liu Die Yu's HijackClick
    vulnerability/exploit(s). It is another one of those sneaky ways to
    trick IE into executing code that is in the Local Zone (on the hard
    disk) bypassing security checks that should apply to Internet Zone
    content. SP2 fixed about a dozen of these exploits, but this one wasn't
    fixed.

    This vulnerability affects SP2, currently to my knowledge the only known
      IE SP2 vulnerability that is exploited in the wild by such as the Akak
    trojan. (There is an image file that will crash IE and Firefox in a DOS
    vulnerability. Called "Bipin's Surprise" or something similar.)

    See http://secunia.com/advisories/12321/ for more information on the
    Drag&Drop vulnerability. Ignore the other vulnerabilities listed for
    IE6, since most/all of them are patched in SP2.

    Mitigation techniques include disabling the Shell Handler using registry
    key changes (eg, provided by Pivx), disabling the new SP2 "binary
    behaviors" setting or, the simplest it seems to me, setting Internet
    zone security to "High" and using the IE5 Power Tweaks to put a new "Add
    site to Trusted Zone" menu item in your tools menu to easily stuff a web
    site into the trusted zone to allow active scripting. Setting your
    Internet Zone to High is an excellent preventative to avoid any number
    of unknown vulnerabilities related to executable web content.

    You can also simply disable active scripting in your current Internet
    zone settings to protect yourself from this exploit. Pivx Quik-Fix and
    Prevx Home tools also protect against this exploit. MS has released no
    patch to fix this, although if they did, it would be similar to the
    adodb.stream patch, relatively simple, but prone to breaking stuff. 

    -- 
Kent W. England, Microsoft MVP for Windows Security
  • Next message: suny: "memory is full"

    Relevant Pages