August 23, 2003
Microsoft Internet Explorer is prone to a security weakness that may permit malicious HTML documents to create or overwrite files on a victim file system when interpreted from the Local Zone (or other Security Zones with relaxed security restrictions, such as the Intranet Zone). This weakness depends on scripting that abuses the ADODB.Stream Object to write an attacker-specified file to the victim file system. In this manner, an HTML document that is interpreted in the context of a Security Zone with relaxed security restrictions may install a malicious file on the victim file system. Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone) and then reference the malicious content once it has been written to the client file system. Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients. This issue was publicized in August 2003 and was previously referenced in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities" but is now being assigned its own BID. There are numerous exploits and worms in the wild that depend on this issue, in tandem with other known vulnerabilities, to install malicious code on client computers.
- Microsoft Internet Explorer 5.5
- Microsoft Internet Explorer 5.5 SP1
- Microsoft Internet Explorer 5.5 SP2
- Microsoft Internet Explorer 6.0
- Microsoft Internet Explorer 6.0 SP1
Run all software as a nonprivileged user with minimal access rights.
Users should perform all non-administrative tasks, such as reading email or browsing the web, as an unprivileged user with minimal access rights. This will limit the impact of this and other latent vulnerabilities.
Do not follow links provided by unknown or untrusted sources.
Users should be wary of visiting websites of questionable integrity or following links provided by unfamiliar or untrusted sources.
Set web browser security to disable the execution of script code or active content.
Disabling client-side scripting and active content in the Internet Zone may limit exposure to this and other latent vulnerabilities.
Do not accept communications that originate from unknown or untrusted sources.
Users should be wary of opening unsolicited email, especially if it contains HTML content. Filtering or disabling HTML email may also limit exposure via this attack vector.
Microsoft has released a knowledge base article KB870669 informing users on how to disable the ADODB.Stream object from Internet Explorer. Please see the referenced article for futher information. Microsoft has also released a Critical Update Windows-KB870669-x86-ENU.exe. This update will disable the ADODB.Stream object.
- Microsoft - Microsoft Knowledge Base Article - 870669
- Jelmer - ADODB.Stream object
- Microsoft - Microsoft Statement Regarding Configuration Change to Windows in Response to Dow
- PivX Solutions - Unpatched IE security holes
- Liu Die Yu - Unpatched Internet Explorer Bugs
- Microsoft - What You Should Know About Download.Ject
Discovery is credited to Jelmer.
© 1995- Symantec Corporation
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from firstname.lastname@example.org.
The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Symantec, Symantec products, Symantec Security Response, and email@example.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.