-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =============================================================================== >> CERT-NL, 01-Mar-2000 << >> All CERT-NL information has been moved to http://cert.surfnet.nl. Links << >> to CERT-NL information contained in this advisory are therefore outdated. << >> << >> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the << >> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the << >> complete CERT-CC advisory texts: http://www.cert.org << =============================================================================== =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Rene Ritzen Index : S-97-17 Distribution : World Page : Classification: External Version: Subject : Microsoft Internet Explorer Vulnerability Date : 05-mar-97 =============================================================================== By courtesy of web-exposed information from Paul Greene, Geoffrey Elliott & Brian Morin, checks by Jorg Bosman of the SURFnet Expertise Centre (SEC), and public confirmation by Microsoft, CERT-NL passes on information on a vulnerability in Microsoft Internet Explorer version 3.01 and earlier for Windows 95 and Windows NT. Microsoft Internet Explorer will execute ".LNK" and ".URL" files appearing on webpages - this execution can result in many things up to your hard disk being deleted. Having tweaked Internet Explorer to its highest security level, including having excluded JAVA and ActiveX, *does not help*. Microsoft published a bug-fix. We recommend to either install this bug-fix, or *not use* Internet Explorer. Details and fix information follow below. =============================================================================== I. DETAILS Quote from Greene, Elliott & Morin : [BEGIN QUOTE] Internet Explorer Bug 2/27/97 (Version 3.0 (4.70.1155)) Microsoft Internet Explorer v3.01 (and earlier?) has a serious bug which allows web page writers to use ".LNK" and ".URL" files to run programs on a remote computer. This bug is particularly damaging because it uses NO ActiveX and works even when Internet Explorer is set to its highest security level. It was tested on Microsoft Internet Explorer Version 3.0 (4.70.1155) running Windows 95. This demo assumes that Windows is installed in "C:\WINDOWS". Windows 95 DOES NOT PROMPT BEFORE EXECUTING THESE FILES. .URL files are WORSE than .LNK files because .URLs work in both Windows 95 and Windows NT 4.0 (.LNK's only work in Windows 95). .URL files present a possibly greater danger because they can be easily created by server side scripts to meet the specific settings of a user's system. [...] The "shortcuts" can be set to be minimized during execution which means that users may not even be aware that a program has been started. Microsoft's implementation of shortcuts becomes a serious concern if a webpage can tell Internet Explorer to refresh to an executable. Or worse, client side scripts (Java, JavaScript, or VBScript) can use the the Explorer object to transfer a BATCH file to the target machine and then META REFRESH to that BATCH file to execute the rogue command in that file. The following table outlines which areas and users each shortcut type effects: File | Windows| Windows| Execute| Command | Searches| Type | 95 | NT | Apps | Line Args| Path | | | | | Allowed | | ====================================================== .LNK | Yes | No | Yes | Yes | No | ------------------------------------------------------ .URL | Yes | Yes | Yes | No | Yes | ====================================================== Security Comparision .URL vs .LNK Naturally, the files must exist on the remote machine to be properly executed. But, Windows 95 comes with a variety of potentially damaging programs which can easily be executed. [...like starting Windows Calculator, or deleting directories...] This bug can be used to wreak havoc on a remote user's machine. [...] [END QUOTE] II. FIX INFORMATION Microsoft has released a security fix for Microsoft Internet Explorer version 3.01 (english version) which can be found at http://www.microsoft.com/ie/security/update.htm Fixes for Microsoft Internet Explorer 3.0 for Windows 95 and Windows NT 4.0 will become available within the next 24 hours. Fixes for the International versions will follow in the next few weeks. After installing the fix Internet Explorer offers the user a choice to either run the .LNK or .URL file or to store it on the local disk. In the opinion of CERT-NL this fix is not complete. The user is still not able to check in advance if the requested .LNK or .URL is safe to run or to download. However CERT-NL recommends that users limit the exploitation of this vulnerability by immediately installing the Microsoft security fix and still check the files they download before they execute them. ============================================================================ CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://cert.surfnet.nl/ In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS Phone: +31 302 305 305 BUSINESS HOURS ONLY Fax: +31 302 305 329 BUSINESS HOURS ONLY Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES: THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED* PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU. =============================================================================== -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQA/AwUBOL6IUDSYjBqwfc9jEQJn5QCg4komC/qTsCDW84WJwv9y1B+dWaQAn0B8 ZZN/9oglMK0A0ikzhLVkhqGU =ugKf -----END PGP SIGNATURE-----