full-disclosure - Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <A16F9DC0E61ACF43AF708AC2D3BE2B060412A3@gracey.internal.compucounts.com>
From: chris at compucounts.com (Chris Carlson)
Subject: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked. 

Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin.  On the downside, I still havn't figured out how to turn it off ;)

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq@...urityfocus.com
> Cc: full-disclosure@...ts.netsys.com; peter@...lomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of 
> arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> Just when I though it was save to once?more?use internet 
> explorer I received an?email bringing my attention to this 
> webpage http://216.130.188.219/ei2/installer.htm ? that 
> according to him used an exploit that affected fully patched 
> internet explorer 6 browsers. Being rather skeptical I 
> carelessly clicked on the link only to witness how it 
> automatically installed addware on my pc!!!
> ?
> Now there had been reports about 0day exploits making rounds 
> for quite some time like for instance this post
> ?
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 
> ?
> However I hadn't seen any evidence to support this up until 
> now Thor Larholm as usual added to the confusion by 
> deliberately spreading disinformation as seen in this post
> ?
> http://seclists.org/lists/bugtraq/2004/May/0153.html
> ?
> Attributing it to and I quote "just one of the remaining IE 
> vulnerabilities that are not yet patched"
> 
> I've attempted to write up an analysis that will show that 
> there are at least 2 new and AFAIK unpublished 
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 
> 
> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the 
> vulnerabilities at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message
> 
>