IE: double slash moves cache from INTERNET zone to MYCOMPUTER zone

[Liu Die Yu]

double slash moves cache from INTERNET zone to MYCOMPUTER zone
("that's all" is the end of file if you are in a hurry)

[tested]
OS:WinXp
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/10/30

[technical detail]
copy an EXE file to your cache directory:
[SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
then try to use CODEBASE trick to execute that file (refer to http://continue.to/trie --> "codebase local path"), you'll get an error message.
however set CODEBASE to:
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
(double slash after [SysDrive])
EXE.EXE in cache directory will be executed.

conclusion:
[SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
is treated in INTERNET zone.
but
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
is treated in MYCOMPUTER zone.

that's all.

of course, it's added to "Unpatched IE Bugs" list maintained by me. here: http://continue.to/trie



[greeting]
greetings to:
the Pull, dror, guninski and mkill.

-----
all mentioned resources can always be found at UMBRELLA.MX.TC

[contact]
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"

[Thor Larholm]

I can only reproduce this from the My Computer zone, which already
allows arbitrary command execution through the codeBase vulnerability -
I don't see anything new in this, but feel free to correct me.



Regards
Thor Larholm
Senior Security Researcher
PivX Solutions, LLC

Get our research, join our mailinglist - http://pivx.com/larholm/

-----Original Message-----
From: Liu Die Yu [mailto:liudieyuinchina@yahoo.com.cn]=20
Sent: Wednesday, November 05, 2003 2:32 AM
To: bugtraq@securityfocus.com
Subject: IE: double slash moves cache from INTERNET zone to MYCOMPUTER
zone


Snip
http://www.securityfocus.com/archive/1/343474/2003-11-02/2003-11-08/0

[3APA3A]

Dear Liu Die Yu,

In my case (XPSP1 + IE6SP1 + all hotfixes) it doesn't work. Probably
it's older bug (same thing was with \\.\Drive:\)

--Wednesday, November 5, 2003, 1:31:53 PM, you wrote to bugtraq@securityfocus.com:



LDY> double slash moves cache from INTERNET zone to MYCOMPUTER zone
LDY> ("that's all" is the end of file if you are in a hurry)

LDY> [tested]
LDY> OS:WinXp
LDY> Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/10/30

LDY> [technical detail]
LDY> copy an EXE file to your cache directory:
LDY> [SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
LDY> then try to use CODEBASE trick to execute that file (refer to http://continue.to/trie --> "codebase local path"), you'll get an error message.
LDY> however set CODEBASE to:
LDY> [SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
LDY> (double slash after [SysDrive])
LDY> EXE.EXE in cache directory will be executed.

LDY> conclusion:
LDY> [SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
LDY> is treated in INTERNET zone.
LDY> but
LDY> [SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
LDY> is treated in MYCOMPUTER zone.

LDY> that's all.

LDY> of course, it's added to "Unpatched IE Bugs" list maintained by me. here: http://continue.to/trie



LDY> [greeting]
LDY> greetings to:
LDY> the Pull, dror, guninski and mkill.

LDY> -----
LDY> all mentioned resources can always be found at UMBRELLA.MX.TC

LDY> [contact]
LDY> UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"


--
~/ZARAZA
Ïîêà âû âî âëàñòè ïðîâèäåíèÿ, âàì íå óäàñòñÿ óìåðåòü ðàíüøå ñðîêà. (Òâåí)