This is an official computer alert.
Andrew N1YEW
----- Original Message -----
From: CERT Advisory <spam_OUTcert-advisoryTakeThisOuT
cert.org>
To: <.....cert-advisoryKILLspam@spam@cert.org>
Sent: Tuesday, April 03, 2001 2:02 PM
Subject: CERT Advisory CA-2001-06
{Quote hidden}>
> -----BEGIN PGP SIGNED MESSAGE-----
>
> CERT Advisory CA-2001-06 Automatic Execution of Embedded MIME Types
>
> Original release date: April 03, 2001
> Last revised: --
> Source: CERT/CC
>
> A complete revision history can be found at the end of this file.
>
> Systems Affected
>
> * All versions of Microsoft Internet Explorer 5.5 SP1 or earlier,
> except IE 5.01 SP2
> * Any software which utilizes vulnerable versions of Internet
> Explorer to render HTML
>
> Overview
>
> Microsoft Internet Explorer has a vulnerability triggered when parsing
> MIME parts in a document that allows a malicious agent to execute
> arbitrary code. Any user or program that uses vulnerable versions of
> Internet Explorer to render HTML in a document (for example, when
> browsing a filesystem, reading email or news messages, or visiting a
> web page), should immediately upgrade to a non-vulnerable version of
> Internet Explorer.
>
> I. Description
>
> There exists in Internet Explorer a table which is used to determine
> how IE handles MIME types when it encounters MIME parts in any type of
> HTML document, be it email message, newsgroup posting, web page, or
> local file. This table contains a set of entries that cause Internet
> Explorer to open the MIME part without giving the end user the
> opportunity to decide if the MIME part should be opened. This
> vulnerability allows an intruder to construct malicious content that,
> when viewed in Internet Explorer (or any program that uses the IE HTML
> rendering engine), can execute arbitrary code. It is not necessary to
> run an attachment; simply viewing the document in a vulnerable program
> is sufficient to execute arbitrary code.
>
> For more details, see Microsoft Security Bulletin MS01-020 on this
> topic at:
>
>
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
>
> There have been reports that simply previewing HTML content (as in a
> mail client or filesystem browser) is sufficient to trigger the
> vulnerability. The impact of viewing malicious code in this manner is
> being evaluated.
>
> The CERT/CC is currently unaware of any reports of this vulnerability
> being used to successfully attack a system. Demonstration code
> exploiting this vulnerability has been published in several public
> forums. This vulnerability is being referenced in CVE as CAN-2001-0154
> and by the CERT/CC as VU#980499.
>
> II. Impact
>
> Attackers can cause arbitrary code to be executed on a victim's system
> by embedding the code in a malicious email, or news message, or web
> page.
>
> III. Solution
>
> Apply the patch from Microsoft
>
> Apply the patch from Microsoft, available at:
>
>
www.microsoft.com/windows/ie/download/critical/Q290108/default.asp
{Quote hidden}>
> As noted in the 'Caveats' section of the Microsoft advisory, end users
> must apply this patch to supported versions of Microsoft's browser.
> This means IE must be upgraded to IE 5.01 Service Pack 1 or IE 5.5
> Service Pack 1 before users can apply this patch. Users who have not
> previously upgraded will incorrectly receive a message stating that
> they do not need to apply this patch, even though they are vulnerable.
> Users are advised to upgrade to IE 5.5 SP1, IE 5.01 SP1 or SP2 (which
> has this patch incorporated in it) and apply the appropriate patch.
>
> An excerpt from MS01-020:
>
> Caveats:
> If the patch is installed on a system running a version of IE other
> than the one it is designed for, an error message will be displayed
> saying that the patch is not needed. This message is incorrect, and
> customers who see this message should upgrade to a supported version
> of IE and re-install the patches.
>
> Appendix A. - Vendor Information
>
> This appendix contains information provided by vendors for this
> advisory. When vendors report new information to the CERT/CC, we
> update this section and note the changes in our revision history. If a
> particular vendor is not listed below, we have not received their
> comments.
>
>
> Cyrusoft International, Inc.
>
> Mulberry does not use Internet Explorer to render HTML within Mulberry
> itself and is not vulnerable to these kinds of problems. Users can
> save HTML attachments to disk and then view those in browsers
> susceptible to this problem, but this requires the direct intervention
> of the user to explicitly save to disk - simply viewing HTML in
> Mulberry does not expose users to these kinds of problems.
>
> Our HTML rendering is a basic styled-text only renderer that does not
> execute any form of scripts. This is true on all the platforms we
> support: Win32, Mac OS (Classic & X), Solaris, linux.
>
> An official statement about this is available on our website at:
>
>
http://www.cyrusoft.com/mulberry/htmlsecurity.html
>
>
> Lotus Development Corporation
>
> Notes does not use IE to render HTML-formatted mail messages.
>
>
> Microsoft Corporation
>
> Please see the advisory (MS01-020, "Incorrect MIME Header Can Cause IE
> to Execute E-mail Attachment") related to this issue at:
>
>
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
>
> A patch is available for this issue at:
>
>
www.microsoft.com/windows/ie/download/critical/Q290108/default.asp
{Quote hidden}>
>
> Netscape Communications Corporation
>
> Netscape is currently investigating the impact this vulnerability, if
> any, has on users of the Netscape browser.
>
>
> Opera Software
>
> Opera does not use Internet Explorer or any other external software to
> render HTML.
>
>
> QUALCOMM Incorporated
>
> It is unclear at this time what impact, if any, this vulnerability has
> on Eudora clients.
>
>
> Appendix B. - References
>
> 1. Havrilla, J., and Hernan, S., "CERT Vulnerability Note VU#980499:
> Certain MIME types can cause Internet Explorer to execute
> arbitrary code when rendering HTML", March 2001.
>
https://www.kb.cert.org/vuls/id/980499
> _________________________________________________________________
>
> Microsoft has acknowledged Juan Carlos Cuartango for bringing this
> issue to their attention.
>
> This document was written by Jeffrey S. Havrilla and Shawn V. Hernan.
> If you have feedback, comments, or additional information about this
> issue, please send us email.
> ______________________________________________________________________
>
> This document is available from:
>
http://www.cert.org/advisories/CA-2001-06.html
> ______________________________________________________________________
>
> CERT/CC Contact Information
>
> Email:
certKILLspamcert.org
> Phone: +1 412-268-7090 (24-hour hotline)
> Fax: +1 412-268-6989
> Postal address:
> CERT Coordination Center
> Software Engineering Institute
> Carnegie Mellon University
> Pittsburgh PA 15213-3890
> U.S.A.
>
> CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
> Monday through Friday; they are on call for emergencies during other
> hours, on U.S. holidays, and on weekends.
>
> Using encryption
>
> We strongly urge you to encrypt sensitive information sent by email.
> Our public PGP key is available from
>
>
http://www.cert.org/CERT_PGP.key
>
> If you prefer to use DES, please call the CERT hotline for more
> information.
>
> Getting security information
>
> CERT publications and other security information are available from
> our web site
>
>
http://www.cert.org/
>
> To subscribe to the CERT mailing list for advisories and bulletins,
> send email to
.....majordomoKILLspam.....cert.org. Please include in the body of your
> message
>
> subscribe cert-advisory
>
> * "CERT" and "CERT Coordination Center" are registered in the U.S.
> Patent and Trademark Office.
> ______________________________________________________________________
>
> NO WARRANTY
> Any material furnished by Carnegie Mellon University and the Software
> Engineering Institute is furnished on an "as is" basis. Carnegie
> Mellon University makes no warranties of any kind, either expressed or
> implied as to any matter including, but not limited to, warranty of
> fitness for a particular purpose or merchantability, exclusivity or
> results obtained from use of the material. Carnegie Mellon University
> does not make any warranty of any kind with respect to freedom from
> patent, trademark, or copyright infringement.
> _________________________________________________________________
>
> Conditions for use, disclaimers, and sponsorship information
>
> Copyright 2001 Carnegie Mellon University.
>
> Revision History
> April 03, 2001: Initial release
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP for Personal Privacy 5.0
> Charset: noconv
>
> iQCVAwUBOsoNNQYcfu8gsZJZAQFd3gQAkCKdIcdKJ/gaii0odrJdM/jlZUv7MYYf
> R8LUHkV1dUTxEI/SRrKtAoEsf/UVVgZI4PGBB/pyptkmSv2axMWf4AD1Ubful712
> ojVaHG7hJuV5RNiw2yE/R4AoWZ5GbdaQByYWpCB+OfwNzsz/7MYibjI6xUtvqRvV
> JxYMB6q5TqM=
> =B0Bv
> -----END PGP SIGNATURE-----
>
--
http://www.piclist.com hint: The list server can filter out subtopics
(like ads or off topics) for you. See http://www.piclist.com/#topics
