Onderwerp: IE: double slash moves cache from INTERNET zone to MYCOMPUTER zone

double slash moves cache from INTERNET zone to MYCOMPUTER zone
("that's all" is the end of file if you are in a hurry)

[tested]
OS:WinXp
Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/10/30

[technical detail]
copy an EXE file to your cache directory:
[SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
then try to use CODEBASE trick to execute that file (refer to http://continue.to/trie --> "codebase local path"), you'll get an error message.
however set CODEBASE to:
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
(double slash after [SysDrive])
EXE.EXE in cache directory will be executed.

conclusion:
[SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
is treated in INTERNET zone.
but
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
is treated in MYCOMPUTER zone.

that's all.

of course, it's added to "Unpatched IE Bugs" list maintained by me. here: http://continue.to/trie



[greeting]
greetings to:
the Pull, dror, guninski and mkill.

-----
all mentioned resources can always be found at UMBRELLA.MX.TC

[contact]
UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"

I can only reproduce this from the My Computer zone, which already
allows arbitrary command execution through the codeBase vulnerability -
I don't see anything new in this, but feel free to correct me.



Regards
Thor Larholm
Senior Security Researcher
PivX Solutions, LLC

Get our research, join our mailinglist - http://pivx.com/larholm/

-----Original Message-----
From: Liu Die Yu [mailto:liudieyuinchina@yahoo.com.cn]=20
Sent: Wednesday, November 05, 2003 2:32 AM
To: bugtraq@securityfocus.com
Subject: IE: double slash moves cache from INTERNET zone to MYCOMPUTER
zone


Snip
http://www.securityfocus.com/archive...2/2003-11-08/0

Dear Liu Die Yu,

In my case (XPSP1 + IE6SP1 + all hotfixes) it doesn't work. Probably
it's older bug (same thing was with \\.\Drive:\)

--Wednesday, November 5, 2003, 1:31:53 PM, you wrote to bugtraq@securityfocus.com:



LDY> double slash moves cache from INTERNET zone to MYCOMPUTER zone
LDY> ("that's all" is the end of file if you are in a hurry)

LDY> [tested]
LDY> OS:WinXp
LDY> Microsoft Internet Explorer v6.Sp1; up-to-date on 2003/10/30

LDY> [technical detail]
LDY> copy an EXE file to your cache directory:
LDY> [SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
LDY> then try to use CODEBASE trick to execute that file (refer to http://continue.to/trie --> "codebase local path"), you'll get an error message.
LDY> however set CODEBASE to:
LDY> [SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\EXE.EXE
LDY> (double slash after [SysDrive])
LDY> EXE.EXE in cache directory will be executed.

LDY> conclusion:
LDY> [SysDrive]:\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
LDY> is treated in INTERNET zone.
LDY> but
LDY> [SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary Internet Files\Content.IE5\
LDY> is treated in MYCOMPUTER zone.

LDY> that's all.

LDY> of course, it's added to "Unpatched IE Bugs" list maintained by me. here: http://continue.to/trie



LDY> [greeting]
LDY> greetings to:
LDY> the Pull, dror, guninski and mkill.

LDY> -----
LDY> all mentioned resources can always be found at UMBRELLA.MX.TC

LDY> [contact]
LDY> UMBRELLA.MX.TC ==> How to contact "Liu Die Yu"


--
~/ZARAZA
Ïîêà âû âî âëàñòè ïðîâèäåíèÿ, âàì íå óäàñòñÿ óìåðåòü ðàíüøå ñðîêà. (Òâåí)