[13032] in bugtraq
The money: protocol in Internet Explorer
daemon@ATHENA.MIT.EDU (Richard M. Smith)
Tue Dec 21 15:48:47 1999
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <NDBBKGHPMKBKDDGLDEEHEECICKAA.smiths@tiac.net>
Date: Mon, 20 Dec 1999 17:12:42 -0500
Reply-To: "Richard M. Smith" <smiths@TIAC.NET>
From: "Richard M. Smith" <smiths@TIAC.NET>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <19991206023202.84801.qmail@hotmail.com>
Hello,
Here is an interesting problem that I haven't had
the time to looking into fully. Maybe someone
else can give it a shot.
If a computer has both Internet Explorer and Microsoft
Money installed on it, Money adds a protocol named "money:" to IE. If
one goes to the IE address box and types in "money:",
Microsoft Money will start up. The protocol also works
in a JavaScript window.open call. This means that Microsoft Money
can be started remotely from a Web site or from an HTML-based
Email message.
Some interesting questions here:
- Does the money: protocol have any buffer overflow
errors such that x86 code can be injected into
Money and then executed?
- What is the URL format for the money: protocol?
For example, can one do something like the
following:
money://transfer?from_acct=myaccount&to_bank=swiss_bank&to_acct_no=12345&amo
unt=10000.00
- If remote attacks are possible, how can the money:
protocol be turned off in Web pages and Email
messages, but still have Microsoft Money work
properly?
Microsoft was demoing Money 2000 at Comdex, and
I showed the money: protocol in IE to the Microsoft
guy running the demo station. His eyes got big as
saucers....... :-)
Richard
==========================================
Richard M. Smith
Internet consultant
Email: smiths@tiac.net
http://www.tiac.net/users/smiths
==========================================
