Microsoft Internet Explorer - Crash on adding sites to restricted zone (05/28/2005)

[Benjamin Tobias Franz]

Microsoft Internet Explorer - Crash on adding sites to restricted zone
(05/28/2005)

Description:
There is a bug in Microsoft Internet Explorer, which causes a crash in
URLMON.DLL.
- EventType : BEX - P1 : IEXPLORE.EXE - P2 : 6.0.2900.2180
- P3 : 41107b81 - P4 : urlmon.dll - P5 : 6.0.2900.2627 - P6 : 422fff74
- P7 : 0005bf61 - P8 : c0000409 - P9 : 00000000
The bug occurs, because Microsoft Internet Explorer can't handle adding of
special-formed URLs to restricted zone. To get a crash, the URL must begin
with numbers and dots (like a correct IP address), but it mustn't end like a
IP address.

Affected software:
Microsoft Internet Explorer

Workaround:
Don't add such URLs to any zone.

Proof-of-Concept exploit:
Add to restricted zone: 4.3.2.1btf-errorreporting.btf.de

Date of discovery:
20. April 2005

Tested software:
Microsoft Internet Explorer 6 SP2 (6.0.2900.2180.xpsp_sp2_gdr.050301-1519)
on a fully patched Windows XP SP2 system.

DLL versions:
MSHTML.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
BROWSEUI.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
SHDOCVW.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
SHLWAPI.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
URLMON.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
WININET.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)


Regards,

Benjamin Tobias Franz
Germany

[Steven M. Christey]

Many browser crashes can be directly triggered by an attacker from a
malicious web page, which makes a reasonable argument for calling such
problems a "vulnerability" or some other term that implies some impact
on confidentiality, integrity, or availability.

However, as described, this particular issue seems to require manual
steps on the user's part, and the attacker has little or no role in
the "exploit," barring social engineering.

There seems to be an implicit agreement that self-inflicted DoSes
don't cross any security boundaries and thus are not security
relevant.

The question, then, becomes whether this particular issue is more of a
"bug" than a "vulnerability" ? If it's a "vulnerability," then how do
you distinguish this from other problems that are just "bugs" ?

- Steve