Most people i talked to consider the Internet Explorer drag and drop
vulnerability found by http-equiv not as a serious problem, because it
requires some user interaction and the press pushes this topic way to much
as the "first security problem in SP2". In an article on BetaNews even
Microsoft claims it's not a high risk for customers
(http://www.betanews.com/article/1093035994).
To proof it's not a "hype" created by the media or companies like secunia, i
created another proof-of-concept based on http-equiv's code that hides both
the image to drag and the local folder you drop it to. As a result using the
window scrollbar will install malware in your startup folder.
A little 5x5 pixel "drop zone" will automaticly follow your mouse. Just drag
the window scrollbar as usual (and a hidden image at the same moment) and
whereever you release the mouse button you will drop an exe file to your
shell:startup (as long as you remain inside the browser window of course).
Demo website: http://www.mikx.de/scrollbar/
Dragging the window scrollbar is a common behavior - even if i can't believe
there was a world before mouse wheels. A common user will probably don't
recognize the installation at all.
Speaking of behaviors: If service pack 2 is installed you can work around
this vulnerability by disabling "binary behaviors" in the new IE activex
settings. You don't need to disable scripting completely.
It took me only 20 minutes to create this, so script kids around the world
with enough free time will create even better protected mechanisms to
exploit this bug in the near future.
Take it serious!
mikx
-----
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such
that just hitting reply is going to result in the message coming to the list,
not to the individual who sent the message. This was done to help reduce the
number of Out of Office messages posters received. So if you want to send a
reply just to the poster, you'll have to copy their email address out of the
message and place it in your TO: field.
-----
