COMMAND

    Internet Explorer

SYSTEMS AFFECTED

    Internet Explorer 5.0

PROBLEM

    Georgi  Guninski  found  following.   Internet  Explorer 5.0 under
    Windows 95, Windows 98and Windows NT 4.0 allows reading local text
    files (the extension does not  matter) and parts of binary  files.
    It is also possible to read text files from any domain and in some
    cases reading files from a web server behind a firewall.

    The problem is the IE feature "download behavior".  It is possible
    to click on a link and  a callback function to be executed.   When
    the callback function is  executed by "startDownload" method,  the
    downloaded file is passed as an argument to the callback function.
    Microsoft  has  implemented  some  security  which  does not allow
    downloading files in this way from a different domain.  But if the
    link points to  a file in  same domain as  the exploit page  and a
    HTTP  redirect  is  forced,  then  the  exploit  works.  It is not
    necessary  the  user  to  click  on  the  link,  this  may be done
    automatically.   This vulnerability  may be  exploited using  HTML
    email message or a newsgroup posting.  The code is:

        <SCRIPT>
        function doit(s)
        {
         alert ("Here is your file:\n"+s);
        }
        </SCRIPT>
        <A ID="oD" STYLE="behavior:url(#default#download)"
        HREF="javascript:oD.startDownload('http://www.nat.bg/~joro/reject.cgi?autoexec',
        doit)">Click here to read C:\AUTOEXEC.BAT</A>.

    "http://www.nat.bg/~joro/reject.cgi?autoexec"  just  does  a  HTTP
    redirect to file://c:/autoexec.bat.  Demonstration is available at

        http://www.nat.bg/~joro/download2.html

    After hearing of some  confusion regarding this vulnerability  Ben
    Greenbaum posted the description from  our SF database.  This  was
    written up  by Eric  Schultze and  him.   The "download  behavior"
    feature of Microsoft's Internet  Explorer 5 may allow  a malicious
    web site operator to read files on an IE5 client computer or on  a
    computer  that  is  in  the  client's 'Local Intranet' web content
    zone.  IE5 introduced a new feature called DHTML Behaviors.  DHTML
    Behaviors allow web developers to encapsulate methods,  properties
    and events that can then be applied to HTML and XML elements.  IE5
    comes with  set of  built-in DHTML  behaviors. One  of them is the
    "#default#download"  behaviors.   This  behavior  defines  a   new
    Javascript   method   called   "startDownload"   that   takes  two
    parameters, the file to download  and a function to call  once the
    file has been downloaded.

    By default the "startDownload" method  checks that the file to  be
    downloaded is in the same web content zone as the file calling the
    method.   When  both  the  file  to  be  downloaded  and  the file
    executing the behavior are in  the same security zone, the  client
    will safely download the  requested file and subsequently  perform
    the specified  function.   A malicious  web site  owner may bypass
    this security restriction and force an IE5 client to both read and
    perform a  follow-up action  on the  contents of  a local  file or
    files in other security zones. This action may include sending the
    contents of  the file  back to  the malicious  web site  operator.
    Here's how it works:

      1: An IE5 client visits a malicious website and loads a web page
         containing  a  client  side  scripting  that makes use of the
         "#default#download" behavior.

      2: The client side  script calls the "startDownload"  method and
         passes it the  URL of a  file to download  and a function  to
         call with the contents of the file once the file is  finished
         downloading.

      3. The startDownload method verifies that the URL is in fact  in
         the same zone as the malicious web server.

      4: The startDownload method begins the download, requesting  the
         URL specified in step 2 from a malicious web server.

      5: The malicious web server send an HTTP redirect to some  other
         file in any  security zone including  local files on  the IE5
         client machine (for example: c:\winnt\repair\sam._).

      6: startDownload  reads  the  file  and  executes  the  function
         specified in step 2 on that file's content.

    The  malicious   web  server   has  now   bypassed  the   security
    restrictions outlined earlier  by successfully forcing  the client
    to load and  act upon a  file that resides  in a web  content zone
    different than that of the  malicious web server. This can  all be
    done transparently to the end user.  This vulnerability cannot  be
    used to delete or modify files on the vulnerable IE5 client.   The
    vulnerability  can  only  retrieve  text  files  or small parts of
    binary files.

SOLUTION

    Disable Active Scripting.  The patch is available for download  at
    either of the following locations:

        http://windowsupdate.microsoft.com
        http://www.microsoft.com/msdownload/iebuild/dlbhav/en/dlbhav.htm