bugtraq - IE HHCTRL exploit still usable even after patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <41ED3F11.6090706@gecadnet.ro>
Date: Tue, 18 Jan 2005 18:53:37 +0200
From: Valentin Avram <vavram@...adnet.ro>
To: bugtraq@...urityfocus.com
Subject: IE HHCTRL exploit still usable even after patch

Hi everybody.

Just wanted to point out that the patch Microsoft released to take care 
of the HHCTRL.OCX vulnerability (MS05-001) is fixing just part of the 
problem.

At least Windows XP Service Pack 1 and Windows 2000 Service Pack 4 are 
still vulnerable to exploiting the HHCTRL vulnerability, by using 
another IE bug not patched yet. I have successfully used the HHCTRL 
exploit on an WinXP SP1 and Win2k SP4 uptodate today (Jan18-2005).

I won't release any technical information for now, i believe that most 
of you already know this.

Service Pack 2 doesn't seem to allow this bypass i used. If anyone knows 
of a way to bypass SP2 and still exploit the HHCTRL way, please let me 
know, we'd like to let people know to be careful (even if they have SP2).

Thank you all for your time.

-- 
Valentin AVRAM
IT Security Engineer
GeCAD NET
Phone: +40-21-321.78.03
E-mail: vavram@...adnet.ro
Web:    www.gecadnet.ro