Microsoft Internet Explorer is prone to a security weakness that may permit malicious HTML documents to create or overwrite files on a victim file system when interpreted from the Local Zone (or other Security Zones with relaxed security restrictions, such as the Intranet Zone). This weakness depends on scripting that abuses the ADODB.Stream Object to write an attacker-specified file to the victim file system. In this manner, an HTML document that is interpreted in the context of a Security Zone with relaxed security restrictions may install a malicious file on the victim file system. Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone) and then reference the malicious content once it has been written to the client file system. Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients. This issue was publicized in August 2003 and was previously referenced in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities" but is now being assigned its own BID. There are numerous exploits and worms in the wild that depend on this issue, in tandem with other known vulnerabilities, to install malicious code on client computers.
Run all software as a nonprivileged user with minimal access rights.
Users should perform all non-administrative tasks, such as reading email or browsing the web, as an unprivileged user with minimal access rights. This will limit the impact of this and other latent vulnerabilities.
Do not follow links provided by unknown or untrusted sources.
Users should be wary of visiting websites of questionable integrity or following links provided by unfamiliar or untrusted sources.
Set web browser security to disable the execution of script code or active content.
Disabling client-side scripting and active content in the Internet Zone may limit exposure to this and other latent vulnerabilities.
Do not accept communications that originate from unknown or untrusted sources.
Users should be wary of opening unsolicited email, especially if it contains HTML content. Filtering or disabling HTML email may also limit exposure via this attack vector.
Microsoft has released a knowledge base article KB870669 informing users on how to disable the ADODB.Stream object from Internet Explorer. Please see the referenced article for futher information. Microsoft has also released a Critical Update Windows-KB870669-x86-ENU.exe. This update will disable the ADODB.Stream object.