Microsoft Active Movie Control文件类型漏洞

漏洞ID	1105826	漏洞类型	输入验证
发布时间	2000-05-13	更新时间	2005-10-20
CVE编号	CVE-2000-0400	CNNVD-ID	CNNVD-200005-052
漏洞平台	Windows	CVSS评分	7.5

|漏洞来源

https://www.exploit-db.com/exploits/19928
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200005-052

|漏洞详情

InternetExplorer5中的MicrosoftActiveMovieActiveXControl没有限制下载文件类型，存在漏洞，攻击者可以通过email消息或新闻贴解码之后下载任何文件到本地系统。

|漏洞EXP

source: http://www.securityfocus.com/bid/1221/info

The Microsoft Active Movie Control (a multimedia ActiveX control) will download files of any type specified in the control parameters in an HTML document, regardless of whether or not they are a valid media type. A hostile website, HTML email or HTML newsgroup post could therefore write executables and other potentially harmful content to target machines, which will be stored with their known filenames in the default Windows Temp directory. 

This vulnerability could be used in conjunction with other exploits to run arbitrary code on the target machine(s).

The following script assumes a default Windows Temp folder of c:windowstemp

<OBJECT classid=clsid:05589FA1-C356-11CE-BF01-00AA0055595A height=1
style="DISPLAY: none" width=1>
<PARAM NAME="Filename" VALUE="C:WINDOWSTEMPMALWARE.exe">

|参考资料

来源:BID
名称:1221
链接:http://www.securityfocus.com/bid/1221
来源:BUGTRAQ
名称:20000516MICROSOFTSECURITYFLAW?
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=95868514521257&w;=2

相关推荐: Samba SMBPrint Sample Script Insecure Temporary File Handling Symbolic Link Vulnerability

Samba SMBPrint Sample Script Insecure Temporary File Handling Symbolic Link Vulnerability 漏洞ID 1098727 漏洞类型 Design Error 发布时间 2004…