Chris Carlson
08/06/04, 07:55
When run remotely:
Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm
When run locally, software installation is blocked.=20
Using IE 6.0.2900.2096 SP2, WinXP SP2
I've gotta say that SP2 has some VERY nice protection builtin. On the =
downside, I still havn't figured out how to turn it off ;)
> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com=20
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of=20
> arbitrary code (An analysis of the 180 Solutions Trojan)
>=20
> Just when I though it was save to once=A0more=A0use internet=20
> explorer I received an=A0email bringing my attention to this=20
> webpage http://216.130.188.219/ei2/installer.htm =A0 that=20
> according to him used an exploit that affected fully patched=20
> internet explorer 6 browsers. Being rather skeptical I=20
> carelessly clicked on the link only to witness how it=20
> automatically installed addware on my pc!!!
> =A0
> Now there had been reports about 0day exploits making rounds=20
> for quite some time like for instance this post
> =A0
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0=20
> =A0
> However I hadn't seen any evidence to support this up until=20
> now Thor Larholm as usual added to the confusion by=20
> deliberately spreading disinformation as seen in this post
> =A0
> http://seclists.org/lists/bugtraq/2004/May/0153.html
> =A0
> Attributing it to and I quote "just one of the remaining IE=20
> vulnerabilities that are not yet patched"
>=20
> I've attempted to write up an analysis that will show that=20
> there are at least 2 new and AFAIK unpublished=20
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated=20
>=20
> You can view it at:
>=20
> http://62.131.86.111/analysis.htm
>=20
> Additionally you can view a harmless demonstration of the=20
> vulnerabilities at
>=20
> http://62.131.86.111/security/idiots/repro/installer.htm
>=20
> Finally I also attached the source files to this message
>=20
>=20
Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm
When run locally, software installation is blocked.=20
Using IE 6.0.2900.2096 SP2, WinXP SP2
I've gotta say that SP2 has some VERY nice protection builtin. On the =
downside, I still havn't figured out how to turn it off ;)
> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com=20
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of=20
> arbitrary code (An analysis of the 180 Solutions Trojan)
>=20
> Just when I though it was save to once=A0more=A0use internet=20
> explorer I received an=A0email bringing my attention to this=20
> webpage http://216.130.188.219/ei2/installer.htm =A0 that=20
> according to him used an exploit that affected fully patched=20
> internet explorer 6 browsers. Being rather skeptical I=20
> carelessly clicked on the link only to witness how it=20
> automatically installed addware on my pc!!!
> =A0
> Now there had been reports about 0day exploits making rounds=20
> for quite some time like for instance this post
> =A0
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0=20
> =A0
> However I hadn't seen any evidence to support this up until=20
> now Thor Larholm as usual added to the confusion by=20
> deliberately spreading disinformation as seen in this post
> =A0
> http://seclists.org/lists/bugtraq/2004/May/0153.html
> =A0
> Attributing it to and I quote "just one of the remaining IE=20
> vulnerabilities that are not yet patched"
>=20
> I've attempted to write up an analysis that will show that=20
> there are at least 2 new and AFAIK unpublished=20
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated=20
>=20
> You can view it at:
>=20
> http://62.131.86.111/analysis.htm
>=20
> Additionally you can view a harmless demonstration of the=20
> vulnerabilities at
>=20
> http://62.131.86.111/security/idiots/repro/installer.htm
>=20
> Finally I also attached the source files to this message
>=20
>=20