| IE5 and Media Player File Exposure |
Reported November 14, 1999 by Georgi Guninski
Internet Explorer 5.0 under Windows 95 (guess other versions are affected) and Windows Media Player ActiveX object allow checking the existence of local files and directories. This vulnerability may be exploited by HTML email or news group posting.
The problem is an error code returned by Windows Media Player ActiveX
Paste this code into an HTML file, save it to your Web server, then access the newly created page using Internet Explorer 5.0. If ActiveX is enabled, the trojan (while harmless) will add itself to your system.
<object id="wm" WIDTH=0 HEIGHT=0
if (b.ErrorCode == -2147220970)<br>
alert("File does not exist")<br>
<INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60><br>
<INPUT TYPE="SUBMIT" VALUE="Check file"
To guard against the risks presented in this bulletin, be sure to adjust control of ActiveX Scripting, Controls, and Plugins on your IE5 Browser. To do so, choose the Tools menu, select Options, and then click the Security tab. On the dialog, choose the Internet zone, and click the Custom Level button, which opens a new dialog. On the new dialog, scroll through the list and adjust all ActiveX properties to either "Disable" or "Prompt." Keep in mind that if you set these controls to "Prompt," you may experience a large number of prompts on the screen while surfing the Internet. If the prompts become a bother, simply readjust the ActiveX properties to "Disable."
Microsoft is aware of this issue, however they have released no statement as of 1pm CST on November 4, 1999.
Discovered by Georgi Guninski
Posted here at NTSecurity.net on November 14, 1999