Microsoft Security Bulletin MS02-009

Discussion in 'other security issues & news' started by Zhen-Xjell, Feb 21, 2002.

Thread Status:
Not open for further replies.
  1. Zhen-Xjell

    Zhen-Xjell Security Expert

    Joined:
    Feb 8, 2002
    Posts:
    1,397
    Location:
    Ohio
    -----BEGIN PGP SIGNED MESSAGE-----

    - -
    - ----------------------------------------------------------------------
    Title:      Incorrect VBScript Handling in IE can Allow Web Pages to
               Read Local Files
    Date:       21 February 2002
    Software:   Internet Explorer
    Impact:     Information Disclosure
    Max Risk:   Critical
    Bulletin:   MS02-009

    Microsoft encourages customers to review the Security Bulletin at:
    http://www.microsoft.com/technet/security/bulletin/MS02-009.asp.
    - -
    - ----------------------------------------------------------------------

    Issue:
    ======
    Frames are used in Internet Explorer to provide for a fuller
    browsing experience. By design, scripts in the frame of one site or
    domain should be prohibited from accessing the content of frames
    in another site or domain. However, a flaw exists in how VBScript
    is handled in IE relating to validating cross-domain access. This
    flaw can allow scripts of one domain to access the contents of
    another domain in a frame.

    A malicious user could exploit this vulnerability by using
    scripting to extract the contents of frames in other domains,
    then sending that content back to their web site. This would
    enable the attacker to view files on the user's local machine
    or capture the contents of third-party web sites the user visited
    after leaving the attacker's site. The latter scenario could,
    in the worst case, enable the attacker to learn personal
    information like user names, passwords, or credit card information.

    In both cases, the user would either have to go to a site under
    the attacker's control or view an HTML email sent by the attacker.
    In addition, the attacker would have to know the exact name and
    location of any files on the user's system. Further, the attacker
    could only gain access to files that can be displayed in a browser
    window, such as text files, HTML files, or image files.

    Mitigating Factors:
    ====================
    - The vulnerability could only be used to view files. It could not
      be used to create, delete, modify or execute them.

    - The vulnerability would only allow an attacker to read files that
      can be opened in a browser window, such as image files, HTML
      files and text files. Other file types, such as binary files,
      executable files, Word documents, and so forth, could not be read.

    - The attacker would need to specify the exact name and location of
      the file in order to read it.

    - The email-borne attack scenario would be blocked if the user were
      using any of the following: Outlook 98 or 2000 with the Outlook
      Email Security Update installed; Outlook 2002; or Outlook
      Express 6.

    Risk Rating:
    ============
    - Internet systems: Moderate
    - Intranet systems: Moderate
    - Client systems: Critical

    Patch Availability:
    ===================
    - A patch is available to fix this vulnerability. Please read the
      Security Bulletin at
      http://www.microsoft.com/technet/security/bulletin/ms02-009.asp
      for information on obtaining this patch.

    Acknowledgment:
    ===============
    - Zentai Peter Aron, Ivy Hungary Ltd (http://w3.ivy.hu/)

    - -
    - ---------------------------------------------------------------------

    THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
    PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
    ALL
    WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
    IN NO EVENT
    SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
    DAMAGES
    WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
    LOSS OF
    BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
    ITS
    SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
    STATES DO
    NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
    OR
    INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 7.1

    iQEVAwUBPHWQ240ZSRQxA/UrAQGVgQf/YHikbABgDGo3VsxZb362rYOKjKpk3Yfl
    o5BH8quzonHYlASh/vRRcys1PtMaVwxdNbDu9DCL2Adg4gDdBrID/Aet3J+f1lgB
    rtKS9SNxwUAd7nht5FX/4SQYXcFlh9oKtr+e6uXZkgED/4TdoTR0JvDOkTh7hvFR
    u4N0eLwRFmgApuftEqaLh3vzxR4V5RoREXDsaJLZLc191MnULFIk4iIASdIIxWiE
    6YJfukAXSlvpWMQolGcEbqinUEHAztCrYpS4Rp5BYeNV3MZWLqkRf7zMu23KTUMi
    rhC+NXtRd2AYM255o0NFn2nlxzBVfc/d7P/GG5BvPTjOQcfLJzZIdg==
    =qlLh
    -----END PGP SIGNATURE-----


    *******************************************************************

    You have received this e-mail bulletin as a result of your subscription to the Microsoft Product Security Notification   Service.  For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.

    To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

    To cancel your subscription, click on the following link mailto:1_26139_1E81A08D-A2CD-4E10-8D7F-16D1039270F8_US@Newsletters.Microsoft.com?subject=UNSUBSCRIBE to create an unsubscribe e-mail.

    To stop all e-mail newsletters from microsoft.com, click on the following link mailto:2_26139_1E81A08D-A2CD-4E10-8D7F-16D1039270F8_US@Newsletters.Microsoft.com?subject=STOPMAIL to create an unsubscribe e-mail.  You can manage all your Microsoft.com communication preferences from http://www.microsoft.com/misc/unsubscribe.htm

    For security-related information about Microsoft products, please  visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.
     
Loading...
Thread Status:
Not open for further replies.