Multiple Vulnerabilities in Microsoft Internet Explorer

[Boldy]

Original issue date: February 02, 2004
Last revised: --
Source: US-CERT

Systems Affected

Microsoft Windows systems running

* Internet Explorer 5.01
* Internet Explorer 5.50
* Internet Explorer 6

Previous, unsupported, versions of Internet Explorer may also be
affected.

Overview

Microsoft Internet Explorer (IE) contains multiple vulnerabilities,
the most serious of which could allow a remote attacker to execute
arbitrary code with the privileges of the user running IE.

Description

Microsoft Security Bulletin MS04-004 describes three vulnerabilities
in Internet Explorer. These vulnerabilities are listed below. More
detailed information is available in the individual vulnerability
notes. Note that in addition to IE, any applications that use the IE
HTML rendering engine to interpret HTML documents may present
additional attack vectors for these vulnerabilities.

VU#784102 - Microsoft Internet Explorer Travel Log Cross Domain
Vulnerability

A cross-domain scripting vulnerability exists in the Travel Log
functionality of Internet Explorer. This vulnerability could allow a
remote attacker to execute arbitrary script in a different domain,
including the Local Machine Zone.
(Other resources: CAN-2003-01026)

VU#413886 - Microsoft Internet Explorer Drag-and-Drop Operation
Vulnerability

Internet Explorer allows remote attackers to direct drag and drop
behaviors and other mouse click actions by using method caching
(SaveRef) to access the window.moveBy method.
(Other resources: CAN-2003-01027)

VU#652278 - Microsoft Internet Explorer does not properly display URLs

Microsoft Internet Explorer does not properly display the location of
HTML documents. An attacker could exploit this behavior to mislead
users into revealing sensitive information.
(Other resources: CAN-2003-01025)

Impact

These vulnerabilities have different impacts, ranging from disguising
the true location of a URL to executing arbitrary commands or code.
Please see the individual vulnerability notes for specific
information. The most serious of these vulnerabilities (VU#784102)
could allow a remote attacker to execute arbitrary code with the
privileges of the user running IE. The attacker could exploit this
vulnerability by convincing the user to access a specially crafted
HTML document, such as a web page or HTML email message. No user
intervention is required beyond viewing the attacker's HTML document
with IE.

Solutions

Apply a patch

Apply the appropriate patch as specified by Microsoft Security
Bulletin MS04-004.

* Microsoft Security Bulletin MS04-004 -
<http://microsoft.com/technet/security/bulletin/MS04-004.asp>

Note: The fix included in MS04-004 for VU#652278 may cause sites that
use URLs of the form "usernameassword@www.example.com" to break.
This change, along with workarounds for users and administrators of
such sites, is covered in Microsoft KB Article 834489.

Vendor Information

This section contains information provided by vendors. When vendors
report new information, this section is updated and the changes are
noted in the revision history. If a vendor is not listed below, we
have not received their comments.

Microsoft

Please see Microsoft Security Bulletin MS04-004.

 

[broughladen]

cheers for that m8.

 

[georges]

thanks for the info boldy

regards

georges

 

[amstrad]

Why anyone still uses MSIE or Outlook is beyond me.

Check out this "workaround" for the harassing spoofed URLs that plague IE users:

A spoofed URL is a URL that uses username/password in the URL to deliberately fool the user into thinking it is link to one host name when it is actually a link to another. IE displays the hostname after @ symbol rather than the proper hostname. Example:

"http://www.cnn.com@some.smut.site" (quotes used to prevent BB from URLifying it).

in this example, the true hostname is "some.smut.site" with a username/password of "www.cnn.com". IE displays the URL when you put your mouse over is as a link to "www.cnn.com" .

Try your browser with that same link (without "code" tags):

http://www.cnn.com@some.smut.site

So you can see how malicious web authors can trick people into following bad links.

However, this is not the worst part. The worst part is Microsoft's fix which is basically this:

"Don't click links, type them in"!!!!?!?!?!?

WTF is that bullshit. Thanks for nothing, MS.

 

[Boldy]

I agree its really a mess. Not to most surfers, but for me as a webmaster/programmer it sucks balls. I probably have to recode 10-20 scripts and programs i did just because of this.

Thanks M$

 

[mike_84]

Ditch IE and use Mozilla.

http://www.mozilla.org/