DATE:  
COMMAND                                            SOURCE: 
                                                   AUTHOR: 
  IE

SYSTEMS AFFECTED

  Windows '95, Internet Explorer v3.01
  

PROBLEM


    A newly (at this momemnt)  discovered third bug exploits the  fact
    that  ".isp"  script  files  may  be  downloaded  and  executed by
    Internet Explorer.  This is  essentially just  another permutation
    of  the  "CyberSnot"  bug  (see  Internet  Explorer #1 on Security
    Bugware).  Author's text can be found at following address:

        http://web.mit.edu/crioux/www/ie/index.html#exploits

    Text used here is part of  author's original text.  This has  been
    discovered by Chris Rioux

    This hole  allows a  malicious web  page to  automatically run any
    program  on  the  user's  hard  drive,  which  means that users of
    Internet  Explorer  could  have   their  hard  drives   completely
    deleted,  their  private  information  stolen,  or  their computer
    infected with a virus merely by looking at a web page.

    This bug  works on  a similar  principle as  the bug discovered at
    WPI.   However, instead  of using  .lnk files  or .url files, this
    bug exploits the fact that other files can also be downloaded  and
    automatically executed without prompting the user for  permission.
    This bug is  not fixed by  the security patch  which Microsoft put
    out for the WPI bug.

    This  bug  has  thus  far  only  been  verified  on the Windows 95
    version of Internet Explorer. This  bug does not appear to  affect
    Windows NT (any service pack/version), in its usual configuration.

    On page mentioned above you can find simple demo exploits which:

        * Download a remote file (think about virus)
        * Create and delete directories (what about your HD)
        * Running a local file (familiar with deltree.exe)

    This bug only requires that a user look at a particular web  page.
    The user does not need to click on any "disguised hyperlinks"  for
    the bug to  be exploited. Our  example exploits demonstrate  this.
    Last time,  it was  mis-reported that  users needed  to click on a
    disguised  hyperlink  to  activate  the  exploit.  In fact, with a
    little more programming  it can be  made automatic so  that a user
    only needs to look at a page (as it is with our bug).



EXPLOIT

  

SOLUTION


    Even  this  is  essentially   just  another  permutation  of   the
    "CyberSnot" bug, however  the patch released  by Microsoft to  fix
    the "CyberSnot" bug does not fix this bug.  Anyway, Microsoft  has
    released their official patch to this bug:

        http://www.microsoft.com/ie/security/download.htm!

    There is also Third-Party Bugfix for those who will not apply
    patch from MS:

        * Start up Internet Explorer
        * Go to the "View" menu and choose "Options..."
        * Click on the "Programs" tab
        * In the "Viewers" section, click on the button labeled  "File
          Types..."
        * Scroll  down to  the "Internet  Communication Settings" list
          item, and highlight it.
        * Click on the "Edit..." button.
        * Check the box at  the bottom of the window  labeled "Confirm
          open after download"
        * Click OK on all of the windows.

    That should cause the browser  to prompt the user for  what he/she
    wishes to do with .ISP files.