SNS Advisory No.48

Problem first discovered: Wed, 13 Feb 2002
Published: Mon, 18 Mar 2002
Revised: Thu, 16 May 2002

Overview:
---------
Microsoft Internet Explorer contains a vulnerability which allows for downloading of a file and its automatic execution under several circumstances without the knowledge of the user. If a malicious webmaster creates a website containing malicious contents that can exploit this problem, and if the user has access to these contents using Internet Explorer under specific environments, then arbitrary programs specified by the administrator will be automatically downloaded and executed on the user's system.

Problem Description:
--------------------
A vulnerability exists in Microsoft Internet Explorer which could lead to automatic downloading and execution of a file under several environments. This can be achieved when a user views contents including the following header in HTTP responses:

Content-Type: audio/x-ms-wma
Content-disposition: inline; filename="foo.exe"

It is important to note that the above-mentioned description is just an example and that this vulnerability has been confirmed exploitable using other Content-Type: headers, such as Content-Type: audio/midi.

This vulnerability affects the following environments: (our previous advisory stated that only IE 6 was affected by this vulnerability, however, it has been confirmed through further investigation that IE 5.01 SP2 is also vulnerable to this issue)

(1) Windows NT 4.0 Workstation + SP6a
+ IE 6 + all available fixes [Japanese version]

(2) Windows NT 4.0 Workstation + SP6a + Windows Media Player 6.4
+ IE 6 + all available fixes [Japanese version]

(3) Windows 2000 Professional + SP2 + SRP1 + Windows Media Player 6.4
+ IE 6 + all available fixes [Japanese version]

(4) Windows 2000 Professional + SP2 + SRP1 + Windows Media Player 6.4
+ IE 5.01 SP2 + all available fixes [Japanese version]

(5) Windows 98 + Windows 98 System Update + Windows Media Player 6.4
+ IE 6 + all available fixes [Japanese version]

(6) Windows 2000 Professional + SP2 + SRP1 + Windows Media Player 7.1
+ IE 6 + Office 2000 SR-1 + all available fixes [Japanese version]

Note: Windows Media Player 6.4 is installed by default on Windows 2000 and Windows 98.

Solution:
---------
This problem can be eliminated by applying a patch based on the information provided by Microsoft Security Bulletin MS02-023.

Microsoft Security Bulletin 02-023:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-023.asp

Discovered by:
--------------
Yuu Arai (LAC) y.arai@lac.co.jp

Acknowledgements:
-----------------
Thanks to:
Microsoft Security Response Center
Japan PSS Security Response Team of Microsoft Asia Limited

Disclaimer:
-----------

All information in these advisories are subject to change without any advanced notices neither mutual consensus, and each of them is released as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences caused by applying those information.

SecureNet Service(SNS) Security Advisory <snsadv@lac.co.jp>
Computer Security Laboratory, LAC http://www.lac.co.jp/security/