Re: IE ms-its: and mk:@MSITStore: vulnerability

[Lise Moorveld]

Hi,

Cool advisory about ms-its(its) and mk:@MSITStorerotocol handlers. I like
the amount of detail supplied. Though due to the detail, it is kinda hard to
get the essence of the advisory.

What, exactly, is new about this?

The PoC mentioned in section a) looks very similar to something Jelmer
posted a while back [1]
and the second bit like something Arman Nayyeri posted [2]
The PoCs in section b) through g) appear to be implementations of the above
(?) but I could be wrong.
And the PoC in section h) seems related to Cert Advisory VU#489721 [3]

Oh, and does anybody know whether this [4] "new IE worm" has anything to do
with anything?

With all the recycling of PoC code and releases of different variations of
exploits it's kinda hard to understand which vulnerabilities lie at the
basis of it all :-/
I vote for more cross-referencing! =)... BID's, CVE-id's and Cert-ID's are
usefull =)

bye,

Lise

[1] http://marc.theaimsgroup.com/?l=full...2317811095&w=2
[2] http://archives.neohapsis.com/archiv...3-12/0337.html
[3] http://www.kb.cert.org/vuls/id/489721
[4] http://archives.neohapsis.com/archiv...4-03/0299.html

__________________________________________________ _______________
MSN Search, for accurate results! http://search.msn.nl

[roozbeh afrasiabi]

In-Reply-To: <BAY17-F16uCddQiqWcB0001d6bb@hotmail.com>

>What, exactly, is new about this?

I did my best to explain this with different pocs and giving a lot of detail but it seems i failed to address this well.The fact that internet explorer can access chm files using the two p-handlers when help has been initiated is new,the fact that some lo
cal resources can be used is also new,and execution of programs on local machine is not done using the old way.
to realize this better try testing the pocs by removing the line that opens help,what you will find out is that the script won't be able to run correctly and no programs will be run.

The pocs i have used in combination with mine were selected from those i thought would be detected by scanners so it won't be possible for people
to simply use them .I have given enough info between the lines for experienced readers too.


>and the second bit like something Arman Nayyeri posted [2]
if i am not mistaken his poc could only run winamp if it had been installed in some known location, while the changes i have made to it gives it the ability to run any program which its' MUICACHE name is known.


>The PoCs in section b) through g) appear to be implementations of the above .And the PoC in section h) seems related to Cert Advisory VU#489721 [3]

These were only included for reader's better understanding and to prove the fact that other programs (ms.products) which use internet explorer for opening html files can be exploited too (god i am giving you clues )