• Microsoft Security Advisory (980088)

  Vulnerability in Internet Explorer Could Allow Information Disclosure

  Published: February 03, 2010

  Version: 1.0

  Microsoft is investigating a publicly reported vulnerability in Internet Explorer for customers running Windows XP or who have disabled Internet Explorer Protected Mode.
• Our investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location
• The vulnerability exists due to content being forced to render incorrectly from local files in such a way that information can be exposed to malicious websites.
• At this time, we are unaware of any attacks attempting to use this vulnerability.

• Mitigating Factors:

  •	Protected Mode in Internet Explorer on Windows Vista and later limits the impact of the vulnerability.
  •	In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.
  •	An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
  •	By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone.
  •	By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e-mail messages in the Restricted sites zone. The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. However, if a user clicks a link in an e-mail message, the user could still be vulnerable to exploitation of this vulnerability through the Web-based attack scenario.

  General Information
• How could an attacker exploit this vulnerability?
  An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site. The attacker could also take advantage of compromised Web sites and Web sites that accept or host user-provided content or advertisements. These Web sites could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes users to the attacker's Web site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.

4 more annotations...

•  

  Microsoft Internet Explorer Information Disclosure Vulnerability

        

  
  

       

  Title : Microsoft Internet Explorer Information Disclosure Vulnerability VUPEN ID : VUPEN/ADV-2010-0291 CVE ID : CVE-2010-0255 CWE ID : VUPEN VNS Only CVSS V2 : VUPEN VNS Only   Rated as : Moderate Risk    Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2010-02-04
• A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to gain knowledge of sensitive information. This issue is caused due to the browser failing to prevent local content from being rendered as HTML via the "file://" protocol, which could allow attackers to access files with an already known filename and location on a vulnerable system and e.g. read the contents of the "index.dat", which would allow them to view the cookies files on the system, and possibly other cached content by tricking a user into visiting a specially crafted web page.
   
   Note : The vulnerability only affects browsers that are not running in Protected Mode. This mode is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008.
   
  Affected Products
   
  Microsoft Internet Explorer 5.x
   Microsoft Internet Explorer 6.x
   Microsoft Internet Explorer 7.x
   Microsoft Internet Explorer 8.x
   
   Microsoft Windows 2000 Service Pack 4
   Microsoft Windows XP Service Pack 3
   Microsoft Windows XP Service Pack 2
   Microsoft Windows XP Professional x64 Edition Service Pack 2
   Microsoft Windows Vista x64 Edition Service Pack 2
   Microsoft Windows Vista x64 Edition Service Pack 1
   Microsoft Windows Vista x64 Edition
   Microsoft Windows Vista Service Pack 2
   Microsoft Windows Vista Service Pack 1
   Microsoft Windows Vista
   Microsoft Windows Server 2008 R2 (x64)
   Microsoft Windows Server 2008 R2 (Itanium)
   Microsoft Windows Server 2008 (x64) Service Pack 2
   Microsoft Windows Server 2008 (x64)
   Microsoft Windows Server 2008 (Itanium) Service Pack 2
   Microsoft Windows Server 2008 (Itanium)
   Microsoft Windows Server 2008 (32-bit) Service Pack 2
   Microsoft Windows Server 2008 (32-bit)
   Microsoft Windows Server 2003 x64 Edition Service Pack 2
   Microsoft Windows Server 2003 SP2 (Itanium)
   Microsoft Windows Server 2003 Service Pack 2
   Microsoft Windows 7 (x64)
   Microsoft Windows 7 (32-bit)

• Secunia Advisory:      SA38416     

    Advisory Toolbox:
    Issue ticket
    Save in to-do list
    Mark as handled
    Exploit information
    Download as PDF
    Review actions
    Add comment 

          Release Date:      2010-02-04        Popularity:      749 views     
        Critical:     
  Moderately critical        Impact:      Exposure of system information
  Exposure of sensitive information
          Where:      From remote        Solution Status:      Unpatched     
    Software:Microsoft Internet Explorer 5.01
  Microsoft Internet Explorer 6.x
  Microsoft Internet Explorer 7.x
  Microsoft Internet Explorer 8.x
• Description:
  Two vulnerabilities have been reported in Internet Explorer, which can be exploited by malicious people to disclose sensitive information.
   
   1) An error in URLMON when handling redirections can be exploited to bypass domain restrictions and disclose the content of arbitrary local files.
   
   This is related to vulnerability #1 in:
   SA35362
   
   2) An error when handling the "data" parameter of a dynamically created object can be exploited to disclose the content of arbitrary local files.
   
   Successful exploitation of the vulnerabilities requires that the full path to a target file is known prior to the attack.
   
   The vulnerabilities are reported in Internet Explorer 5.01, 6, 7, and 8.
  

• The flaw, said to extend across all versions of Internet Explorer, is not subject to a patching fix, according to Jorge Luis Alvarez Medina, the Argentina-based security consultant with Core Security Technologies who elaborated on the attack technique during his demo. Indeed, Microsoft advised anyone concerned about the potential for this type of attack to run IE in "protected mode," a workaround that Medina also advised.
• The exploit demonstrated by Medina basically involves "chaining the exploitation of a series of weak features." He said the dialog with Microsoft's security team about the exploit so far has indicated that Microsoft thinks this is not something it can fix because the flaw is so much a part of the fundamental design of the browser.