bugtraq - Discussion: Microsoft(R) PowerPoint “Action Settings” feature allows invocation of default browser pointed at arbitrary URL.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 16 Dec 2004 15:01:28 -0000
From: Monte Ratzlaff <advisories@...fosystems.com>
To: bugtraq@...urityfocus.com
Subject: Discussion: Microsoft(R) PowerPoint “Action Settings” feature
    allows invocation of default browser pointed at arbitrary URL.

Discussion: Microsoft(R) PowerPoint “Action Settings” feature allows invocation of default browser pointed at arbitrary URL.  PowerPoint version tested: 2002 with SP3.

Reason for discussion:
For business reasons Microsoft(R) PowerPoint (ppt) files are allowed attachments in most enterprise email gateways.  This discussion is aimed at the need for reviewing this policy.

When configured by the slide author, the PowerPoint “Action Settings” feature allows for some automatic activity.  Although this feature is not new and there are a number of actions that can be performed with this feature, I offer two scenarios of one issue.

A victim is sent an email with a Microsoft(R) PowerPoint (ppt) file containing a slide with a picture or object which has “Action Settings” “Mouse Over” properties configured to visit a URL.
If the victim runs the PowerPoint show and moves the mouse over the picture or object the default browser is launched pointing to the URL as defined by the slide author in the “Action Settings: Mouse Over” properties.

Scenario 1:
Action Settings | Mouse Over | Hyperlink to: URL <malicious site>
It’s obvious there could be any malicious site pointed to here for scripting, spyware installation, phishing, etc.  When the victim moves the mouse pointer over the picture/object the page is launched using the victim’s default browser.

Mitigating factors for Scenario 1:
The victim would have to run the PowerPoint show and move the mouse over the picture/object.
The browser/system would need to be vulnerable to an exploit used in the script attack.

Scenario 2 (not thoroughly tested):
Action Settings | Mouse Over | Hyperlink to: URL \\<server_ip>\<share_dir>\<file>

When the victim moves the mouse pointer over the picture/object the following exchange occurs automatically.
An SMB NTLM challenge is sent to the victim's PC from the attacking server and the victim's PC will automatically respond to the challenge with an SMB NTLM authentication.
If the attacker is running a sniffer the victim's IP, SMB NTLM authentication (with the user name and password hash) is captured for future "analysis".

Mitigating factors for Scenario 2:

The victim would have to run the PowerPoint show and move the mouse over the picture/object.
Attacking server would have to allow incoming sessions.
The victim’s PC would have to be allowed session information over the network/Internet (unconfirmed).

RELATED FACTS:
*While there is a social engineering component to these attacks is not uncommon for recipients to open ppt files, run the show, and either use the mouse to click through the show or click when prompted.
*Many Microsoft(R) vulnerabilities are stamped with the mitigating factor: "An attacker would have no way to force users to visit a malicious Web site."
*SPAMmers are continually changing the methods used to generate traffic to sites.
*Spyware is a problem plaguing many organizations.

Conclusion:
With the threat of phishing schemes, SPAM, spyware, malicious scripts, and vulnerable browsers/systems, the policy of allowing Microsoft(R) PowerPoint (ppt) files to pass through email gateways should be reviewed.