From:	SMTP%"everhart@mail09.mitre.org" 15-JAN-1998 16:35:27.05
To:	everhart@gce.com (everhart@gce.com)
CC:	
Subj:	FWD: Re: L0pht Advisory MSIE4.0(1)

Return-Path: everhart@mail09.mitre.org
Received: by arisia.gce.com (UCX V4.1-12C, OpenVMS V7.1 VAX);
	Thu, 15 Jan 1998 16:31:09 -0500
Received: from mbunix.mitre.org (mbunix.mitre.org [129.83.20.100]) by mercury.mv.net (8.8.8/mem-971025) with ESMTP id HAA28204 for <everhart@gce.com>; Thu, 15 Jan 1998 07:55:37 -0500 (EST)
Received: from TGATE3 (tgate3.mitre.org [129.83.20.27])
	by mbunix.mitre.org (8.8.8/8.8.8/mitre.0) with ESMTP id HAA20088
	for <everhart@gce.com>; Thu, 15 Jan 1998 07:58:12 -0500 (EST)
Received: from mail09.mitre.org (unverified [129.83.20.43]) by tgate3.mitre.org (EMWAC SMTPRS 0.83) with SMTP id <B0005697932@tgate3.mitre.org>; Thu, 15 Jan 1998 07:58:12 -0500
Received: by mail09.mitre.org; (5.65v3.2/1.1.8.2/22Jun94-0628PM) id AA01767; Thu, 15 Jan 1998 07:58:06 -0500
Subject: FWD: Re: L0pht Advisory MSIE4.0(1)
From: everhart@mail09.mitre.org (Glenn C. Everhart)
To: everhart@gce.com (everhart@gce.com)
Message-Id: <980115075805.18556@mail09.mitre.org.0>
Date: Thu, 15 Jan 98 07:58:06 -0500
X-Mailer: MailWorks 2.0-4
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===_tgate3_6664_96019091_==="

--===_tgate3_6664_96019091_===
Content-Type: text/plain; charset="us-ascii"

----- Forwarded message follows -----
Approved-By: aleph1@UNDERGROUND.ORG
References: <Pine.BSI.3.96.980114114117.4986A-100000@c0re.l0pht.com>
Lines: 108
Date: Wed, 14 Jan 98 17:45:25 -0500
Reply-To: Linus Nordberg <nordbelm@DECUS.SE>
From: Linus Nordberg <nordbelm@DECUS.SE>
Subject: Re: L0pht Advisory MSIE4.0(1)
X-Cc: DilDog <dildog@L0PHT.COM>
To: <BUGTRAQ@NETSPACE.ORG>
In-Reply-To: DilDog's message of Wed, 14 Jan 1998 11:42:53 -0500

DilDog <dildog@L0PHT.COM> writes:

>
>       Document:  L0pht Security Advisory
>     URL Origin:  http://l0pht.com/advisories.html
>   Release Date:  January 14th, 1998
>    Application:  Microsoft Internet Explorer 4.0(1) Suite
>       Severity:  Viewing remote HTML content can execute arbitrary native code
>         Author:  dildog@l0pht.com
>  Operating Sys:  Windows 95 and Windows NT
>

buffer overflows comes to redmond...
especially interresting when the msie code is used in almost every
application nowadays.

below is a program that tries to find out what file is downloaded and
executed. paste the vicous url into a file and give the filename as
only argument or cat it in on stdin.

yes, it's kind of lame. i know that.

-------------------
/*
 * whaturl.c
 *
 * prints the url that the l0pht msie-overflow is downloading by
 * doing bytewise XOR on the "exploit url", using some magic values
 * it tries to find in the url.
 *
 * see http://www.l0pht.com/advisories.html for details on the exploit.
 *
 * this program is easily fooled by anyone that crafts its own
 * urls, but a fair guess is that most of us are too lazy/lame to do
 * that.
 *
 * --linus
 */

#include <stdio.h>
#define MY_EOS (0)

/* signum for finding the magic value to XOR with */
unsigned char signum[] =
{0x80, 0x01, MY_EOS};           /* add b,[ecx],? */


int matchsignum(char c)
{
        static char *cp = signum;

        if (*cp == c) {
                if (*++cp == MY_EOS)
                        return 1;
        } else
                cp = signum;

        return 0;
}

int main(int argc, char *argv[])
{
        int sigfound, ixor, bread, i, j;
        unsigned char xorval[64], inbuf[0xffff], *cp;
        FILE *fin = NULL;

        if (argc)
                fin = fopen(argv[1], "rb");

        if (fin == NULL)
                fin = stdin;

        bread = fread(inbuf, sizeof(*inbuf), sizeof(inbuf), fin);
        if (!feof(fin))
                return 1;

        /* find possible XOR-values */
        sigfound = ixor = 0;
        for (i = 0, cp = inbuf; i < bread; i++, cp++) {
                if (sigfound) {
                        for (j = 0; j < ixor; j++)
                                if (*cp == xorval[j])
                                        break;
                        if (*cp != xorval[j])
                                xorval[ixor++] = *cp;
                        sigfound = 0;
                } else
                        sigfound = matchsignum(*cp);
        }

        if (!ixor) {
                fprintf(stdout, "%s: signum not found, trying 0x80\n", argv[0]);
                ixor = 1;
                xorval[0] = 0x80;
        }
        /* todo: where does the url start? for now, print the lot. */
        while (ixor--) {
                printf("%s: xorval %#02x -->\n", argv[0], xorval[ixor]);
                for (i = 0, cp = inbuf; i < bread; i++, cp++)
                        putchar(*cp ^ xorval[ixor]);
                putchar('\n');
        }

        fclose(fin);
        return 0;
}
---------------
--linus


----- End of forwarded message -----

--===_tgate3_6664_96019091_===--

