full-disclosure - New IE Thread crashes by WU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <003f01c3cf79$f1add680$0a0a0a0a@LocalHost>
From: Admin at SecureTarget.Net (Kaveh Mofidi)
Subject: New IE Thread crashes by WU

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Secure Target Network (Security Advisory December 31, 2003) 
Topic: New IE Thread crashes by WU
Discovery Date: December 30, 2003
Link to Original Advisory: http://securetarget.net/advisory.htm

Affected applications and platforms: 
Microsoft Internet Explorer 6 Service Pack 1

Introduction: 
Any time you open your Windows Update (WU / wupdmgr.exe) and go to
"Scan for Updates"; it takes a couple of minutes (based on your
system and Net performances) for Microsoft scripting tasks to gather
information from your fixing/patching data on your machine.
A security bug exist because when you are in the period which WU
scanning your host, you cannot open any New IE windows from some
applications and opening this new window just takes time, as long as
WU ending its scanning, and it means hanging.
First, it is a security bug because it faces with availability of a
component on a windows box. Second, it happens when you open a new IE
window from these two situations below:
1. Opening a new IE window by clicking on a hyper link in OE.
2. Opening a new IE window by clicking on a hyper link in IE.
Remember that for facing with this issue, you shouldn't have an old
IE Thread opened from OE or IE before.

Exploit: 
This bug may not provide an opportunity to threat a windows box
machine with attacks and exposures but it may cause DoS anyway.

Workaround: 
The easiest way to work around this vulnerability is just let WU
finishing its scanning and then work with IE and OE as usual.

Tested on: 
Internet Explorer 6 Service Pack 1 (6.0.2800.1106) and Outlook
Express 6.00.2800.1123 on Windows XP Service Pack 1

Feedback: 
Kaveh Mofidi (Admin@...ureTarget.Net) 
Secure Target Network (Security Consulting/Training Group) 
HTTP://SECURETARGET.NET

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBP/KLYmO1siv41icpEQL+wgCfR6RTEDjlny+xZWtPWuqneFzKbOkAn3Ag
PcIUaNBYYXjm6itPd+4wBxD1
=yekc
-----END PGP SIGNATURE-----
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031231/64f43dd8/attachment.html