Vulnerability Development mailing list archives
Re: Win 2000 & IE 'shell://' problem?
From: lamerhq () GMX DE (Tobias Paprotta aka friedbits)
Date: Mon, 1 May 2000 13:40:45 -0500
At 15:33 30.05.2000 -0500, Stephen John wrote:
I found that IE 5 running Win 2000 accepts "shell://" as a legal protocol, and when any URL ie "shell://localhost" or just "shell://" is loaded IE crashes and brings explorer.exe down with it. I think this would cause a user who didnt know much to think that Win 2000 had crashed (of course killing the tasks iexplore.exe and explorer.exe then restarting explorer, will solve the problem). I don't think this is a huge security hole, but being able to crash explorer remotely is a security problem. This can be exploited via a <A href=shell://somehost>Kill explorer!></A> or if scripting is on, by embedding a onLoad="window.location='shell://localhost'" into the body tag. It takes about 5 seconds to crash IE/explorer, the IE window blinks a few times before the crash. I'm not sure what IE is trying to do here, but it is never sucsessful. I was able to reproduce this on 2 systems with Win 2000 Professional 5.00.2195, using IE 5.00.2920.0000. I tested this on a Win 98 Machine running IE 5.00.2919.6307 and I did not see this behavior. Also Netscape does not seem to recognize shell:// as a valid protocol. Could anyone see if this problem is occurs on other version of NT/IE, or maybe is there is a better way to exploit it? Stephen John Student University of Texas Webmaster <http://www.securityauditor.com>http://www.securityauditor.com
I have tested this on the German release version on windows 2000 and found it non-working. 5.00.2920.0000 is the version of IE this was tested on under win2k 5.00.2195. However the IE accepts the URL and seems to open a few windows and close them. However I can't reproduce the crash of IE and explorer here. NT4.0 Server sp5 running IE 5 doesnt seem to be vurnerable either Tobias Paprotta tobias () paprotta de Security Consultant - nsc solutions, Germany - www.nsc-solutions.com -- Use OpenBSD - Security enabled by Default - www.openbsd.org --
Current thread:
- Win 2000 & IE 'shell://' problem? Stephen John (May 30)
- Re: Win 2000 & IE 'shell://' problem? Tobias Paprotta aka friedbits (May 01)
- Re: Win 2000 & IE 'shell://' problem? Ilya (May 30)
- Re: Win 2000 & IE 'shell://' problem? vamp (May 30)
- <Possible follow-ups>
- Re: Win 2000 & IE 'shell://' problem? Silcock, Stephen (May 30)
- Re: Win 2000 & IE 'shell://' problem? Rob Beneson (May 30)
- Re: Win 2000 & IE 'shell://' problem? Walter Williams (May 31)
- Re: Win 2000 & IE 'shell://' problem? bacano (May 31)
- Re: Win 2000 & IE 'shell://' problem? Fernando Cardoso (May 31)
- Re: Win 2000 & IE 'shell://' problem? netsec [davidv] (May 31)
- Re: Win 2000 & IE 'shell://' problem? Matthew King (May 31)
- Re: Win 2000 & IE 'shell://' problem? Stephen John (May 31)
(Thread continues...)