The latest cumulative patch from Microsoft,
http://www.microsoft.com/technet/security/bulletin/MS02-023.asp , promises
to eliminate "six newly discovered vulnerabilities", but fails to do so.
First, we find what MS calls "A cross-site scripting vulnerability in a
Local HTML Resource". This is obviously a reference to the dialogArguments
vulnerability, and as such this mislabelling name does not bode well to
begin with. In fact, MS seems to have misunderstood quite a number of issues
surrounding this vulnerability. The first such is found in their list of
mitigating factors:
"A successful attack requires that a user first click on a hyperlink. There
is no way to automate an attack using this vulnerability. "
The above is blatantly untrue, and was repeatedly demonstrated to MS both in
the initial notification phase and when we worked together to reproduce the
issue. Nothing in the world stops this vulnerability from being
automatically exploited.
Another 'mitigating' factor:
"Outlook 98 and 2000 (after installing the Outlook Email Security Update),
Outlook 2002, and Outlook Express 6 all open HTML mail in the Restricted
Sites Zone. As a result, customers using these products would not be at risk
from email-borne attacks. "
The above is merely misinformation on their parts. The Restricted Sites Zone
tries to disable scripting ( a requisite for the dialogArguments
vulnerability ), but many vulnerabilities allow you to circumvent this
setting ( one such listed on /unpatched/ ). As such, you can still script in
the Restricted Sites Zone, and as such "customers using these products" are
still at risk from email-borne attacks.
Aside from these misunderstandings it could appear as though Microsoft is
not actively keeping up with the security community and its publications.
The dialogArguments issue was originally demonstrated with a ressource file
only found in Internet Explorer 6- Shortly after being disclosed GreyMagic
Software highlighted how another ressource file was also vulnerable, which
existed from IE5 and onwards. Microsoft has fixed the vulnerability in IE6
_only_.
I repeat, IE5 and IE5.5 are still vulnerable.
The same severity rating (Critical) also apply to IE5 and IE5.5, with the
exception that they still remain unpatched. The demonstration was fixed
instead of the vulnerability. If you want to convince yourself about this
(and still use the appareantly unsupported IE5 or IE5.5 browser), try the
examples in GreyMagics appendix to my advisory at
http://sec.greymagic.com/adv/gm001-ax/ .
Next, we find that the cssText vulnerability should be patched. Most of my
systems behave properly and appear to have this vulnerability patched,
though some still allow local file reading. More testing needed, but likely
not a job full done. So far it appears patched.
The "Script within Cookies Reading Cookies" vulnerability also have the same
incorrect 'mitigating' factor as dialogArguments, and claims that
"An attacker would have to entice a user to first click on a hyperlink to
initiate an attempt to exploit this vulnerability. There is no way to
automate an attack that exploits this vulnerability."
Of course, this is also untrue since Internet Explorer comes equipped with a
nice click method on links that a programmer can execute, duplicating an
actual click (
http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/click.asp
). As such, nothing stops anyone from exploiting this vulnerability
automatically.
The "zone spoofing" vulnerability sounds interesting, but I can find no
further details (MS is not exactly full disclosure).
And finally we have two variants of the "Content Disposition" vulnerability.
The first depends on an unknown thirdparty program (your guess is as good as
mine). The second depends on an executable being present, and has a
misinforming mitigating factor:
"Any attempt to exploit the vulnerability requires that the attacker host a
malicious executable on a server accessible to the intended victim. If the
hosting server is unreachable for any reason, such as DNS blocking or the
server being taken down, the attack would fail. "
The above seems to discuss an email-borne attack, and as such there is no
dependancy on external servers. Outlook can easily parse attached
executables through CID: (Content-ID) and as such this mitigating factor is
quite minute since the email itself would act as the hosting server.
Yesterday I hosted a list of 14 publickly known unpatched vulnerabilities,
today I host a list of 12 such. It can still be found at
http://jscript.dk/unpatched/
Just my .02 kroner of comments :)
Regards
Thor Larholm
Jubii A/S - Internet Programmer
