COMMAND
Internet Explorer v3.01
SYSTEMS AFFECTED
Windows '95
PROBLEM
A newly (at this momemnt) discovered third bug exploits the fact
that ".isp" script files may be downloaded and executed by
Internet Explorer. This is essentially just another permutation
of the "CyberSnot" bug (see Internet Explorer #1 on Security
Bugware). Author's text can be found at following address:
http://web.mit.edu/crioux/www/ie/index.html#exploits
Text used here is part of author's original text. This has been
discovered by Chris Rioux
This hole allows a malicious web page to automatically run any
program on the user's hard drive, which means that users of
Internet Explorer could have their hard drives completely
deleted, their private information stolen, or their computer
infected with a virus merely by looking at a web page.
This bug works on a similar principle as the bug discovered at
WPI. However, instead of using .lnk files or .url files, this
bug exploits the fact that other files can also be downloaded and
automatically executed without prompting the user for permission.
This bug is not fixed by the security patch which Microsoft put
out for the WPI bug.
This bug has thus far only been verified on the Windows 95
version of Internet Explorer. This bug does not appear to affect
Windows NT (any service pack/version), in its usual configuration.
On page mentioned above you can find simple demo exploits which:
* Download a remote file (think about virus)
* Create and delete directories (what about your HD)
* Running a local file (familiar with deltree.exe)
This bug only requires that a user look at a particular web page.
The user does not need to click on any "disguised hyperlinks" for
the bug to be exploited. Our example exploits demonstrate this.
Last time, it was mis-reported that users needed to click on a
disguised hyperlink to activate the exploit. In fact, with a
little more programming it can be made automatic so that a user
only needs to look at a page (as it is with our bug).
SOLUTION
Even this is essentially just another permutation of the
"CyberSnot" bug, however the patch released by Microsoft to fix
the "CyberSnot" bug does not fix this bug. Anyway, Microsoft has
released their official patch to this bug:
http://www.microsoft.com/ie/security/download.htm!
There is also Third-Party Bugfix for those who will not apply
patch from MS:
* Start up Internet Explorer
* Go to the "View" menu and choose "Options..."
* Click on the "Programs" tab
* In the "Viewers" section, click on the button labeled "File
Types..."
* Scroll down to the "Internet Communication Settings" list
item, and highlight it.
* Click on the "Edit..." button.
* Check the box at the bottom of the window labeled "Confirm
open after download"
* Click OK on all of the windows.
That should cause the browser to prompt the user for what he/she
wishes to do with .ISP files.