FW: failure notice

[Ken Pfeil <Ken () infosec101 org>]

Just in case anyone uses IE with Sharepoint.. Boom.

----- Forwarded message from secure () microsoft com -----
    Date: Tue, 28 Mar 2006 11:47:12 -0800
    From: Microsoft Security Response Center <secure () microsoft com>
Reply-To: Microsoft Security Response Center <secure () microsoft com>
 Subject: RE: Another Attack Vector
      To: Ken () infosec101 org

Hi Ken,

Thanks for getting back to me. I will pass your comments on to the case
manager handling this behavior with the SharePoint team.

Thanks,
Christopher, CISSP

-----Original Message-----
From: Ken () infosec101 org [mailto:Ken () infosec101 org]
Sent: Tuesday 28 March 2006 11:42
To: Microsoft Security Response Center
Subject: RE: Another Attack Vector

Thank you Christopher,

But there are a bazillion different scenarios where this could be
slightly more than detrimental. There are literally hundreds of sites
using Sharepoint for blogs, and anonymous access is an option turned on
by default. For a real working example, please open the file
IE_Exploit.txt on the below site and watch filemon dance a jig..

Best,
Ken


Quoting Microsoft Security Response Center <secure () microsoft com>:

> Hi Ken,
>
> Thanks for your note. This is by-design behavior with SharePoint and
> Internet Explorer and, as you mentioned, is related to IE MIME type
> detection. The mitigating circumstance in this scenario is that
> SharePoint sites are authenticated and it would be possible to "audit
> and punish" the attacker. Just the same, I'll pass this on to the case

> manager for this investigation.
>
> Thanks,
> Christopher, CISSP
>
> -----Original Message-----
> From: Ken () infosec101 org [mailto:Ken () infosec101 org]
> Sent: Tuesday 28 March 2006 09:16
> To: Microsoft Security Response Center
> Subject: Another Attack Vector
>
> There is yet another attack vector for createTextRange() (besides
> untrusted websites). Windows Sharepoint. If you create a txt file with

> html tags and post it, say in "Shared Documents", IE will render it as

> HTML in the browser when the document is clicked on instead of
> displaying as text. Example:
> https://foo.org/Shared%20Documents/test2.txt (code is
> simple html here, but could have been dangerous). You might want to
> update your advisory to include this.
>
> (And, I know you can de-select "Open Files Based on Content, not file
> extension" under IE, but that opens your host to *other*
> vulnerabilites.)
>
> Username for the system above for a sample doc is:
> testuser with password of password.
>
> Best,
> Ken





----- End forwarded message -----