Georgi Guninski security advisory #7 - There is a vulnerability in Wordpad which allows executing arbitrary programs without warning the user after activating an embedded or linked object. This may be also exploited in IE for Win9x. Demonstration which starts AUTOEXEC.BAT available here.
8c815d047dd5d9b4e8a06fecc24985c9005b8075decd685d753f14bceca1b2b7
Georgi Guninski security advisory #7, 2000
Wordpad vulnerability, exploitable also in IE for Win9x
Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or indirect use
of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.
Description:
There is a vulnerability in Wordpad which allows executing arbitrary
programs without warning the user after activating an embedded or linked
object. This may be also exploited in IE for Win9x.
Details:
Wordpad executes programs embeded in .doc or .rtf documents without any
warning if the object is activated by doubleclick.
This may be exploited in IE for Win9x using the view-source: protocol.
The view-source: protocol starts Notepad, but if the file is large, then
the user is asked to use Wordpad. So creating a large .rtf document and
creating a HTML view-source: link to it in a HTML page or HTML based
email message will prompt the user to use Wordpad and a program may be
executed if the user doubleclicks on an object in the opened document.
Demonstration which starts AUTOEXEC.BAT:
http://www.whitehats.com/guninski/wordpad1.html
Workaround: Do not activate objects in Wordpad documents
Copyright Georgi Guninski
Regards,
Georgi Guninski
http://www.nat.bg/~joro