Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Browsers :: expl1334.htm

MSIE/Outlook allow reading local files
26th Sep 2000 [SBWID-1334]

	 IE/Outlook Express




	 IE 5.5/Outlook Express

	 Patched IE 6.0, somewhat patched 5.5 Win2K





	    Following is  based on  a Georgi  Guninski security  advisory #22.

	    Internet Explorer 5.5/Outlook Express/(probably Outlook if  Active

	    Scripting is  enabled) under  Windows 98/2000  (suppose all  other

	    versions are also vulnerable) allow reading local and UNC files.


	    The problem is the GetObject() JScript function and the \"htmlfile\"

	    ActiveX  object.   A  call  a=GetObject(\"c:\\test.txt\",\"htmlfile\")

	    creates  a  HTML  document  object  with  full  access to its DOM.

	    Examine the code for details.  The code is:



	        alert(\"This script reads C:\\TEST.TXTnYou may need to create it\");






	    Demonstration is available at:



	    Just a quick note: if you have configured explorer so that it asks

	    you before executing ActiveX, it will prompt you before  executing

	    the above script.  Tested on IE5.0/Win2000.





	If you replace the function  with



	latest version (IE6.0) is still vulnerable


	    Disable Active Scripting.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH