bugtraq - Invalid ContentType may disclose cache directory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031125100242.24043.qmail@sf-www2-symnsj.securityfocus.com>
Date: 25 Nov 2003 10:02:42 -0000
From: Liu Die Yu <liudieyuinchina@...oo.com.cn>
To: bugtraq@...urityfocus.com
Subject: Invalid ContentType may disclose cache directory

Invalid ContentType may disclose cache directory

[tested]
OS:WinXp, CN version
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/11/16

[overview]
The problem lies in the download function of Internet Explorer. This can be exploited by malicious web pages to get cache directory including random names.

[demo]
There are two harmless demos:
1st, online demo, powered by ASP:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo
2nd, demo in ZIP format, powered by NETCAT:
http://www.safecenter.net/UMBRELLAWEBV4/threadid10008/threadid10008-Demo.zip

[technical details]
When CONTENTTYPE in HTTP response is invalid and file extension is "HTM", the downloaded HTM file will be opened in cache directory, in INTERNET security zone.

In the 1st demo, this is done by the following ASP code:
----------
response.ContentType = "whocares"
response.AddHeader "content-disposition", "inline; filename=test.htm"
----------

In the 2nd demo, this is done with the help of NETCAT.

[Workaround]
Disable Active Scripting in INTERNET zone, so HTML page opened in the cache can't send information back to the attacker.

[Greetings]
greetings to:
Drew Copley, dror, guninski and mkill.

-----
all mentioned resources can always be found at UMBRELLA.MX.TC

[people]
LiuDieyuinchina [N0-@...2m] yahoo.com.cn
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"

[Employment]
I would like to work professionally as a security researcher/bug finder. 

See my resume at my site. I am very eager to work, flexible, and 
extremely productive. I have a top notch resume, with credentials 
from leading bug finders. I am willing to work per contract, relocate, 
or telecommute. 

[Give a Hand]
I haven't got a job as a security researcher yet and my family don't support my security work - so, I don't have a computer of my own. Please consider about donating at:
http://clik.to/donatepc