URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
--8323329-437043848-1191580876=:5461
Content-Type: TEXT/PLAIN; CHARSET=iso-8859-15; FORMAT=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-ID: <alpine.DEB.0.82.0710051242411.5461@loki.ct.heise.de>
Hello,
the URI handling problem on Windows XP systems with IE 7 installed hits a=
=20
lot of applications, not only Firefox (and mIRC) -- namely Skype, Acrobat=
=20
Reader, Miranda, Netscape.
To recap: with the installation of IE 7 Microsoft=20
changes the handling of URLs that are passed to the operating system on=20
Windows XP. After this, URLs that contain an invalid "%" encoding can=20
launch abitrary programms. One example is:
mailto:test%../../../../windows/system32/calc.exe".cmd
that launches the calculator when activated in affected applications.=20
Firefox fixed this problem in 2.0.6. After being notified by heise=20
Security, Skype fixed the problem in 3.5.0.239.
Still vulnerable (as of 4th of October) are:
Adobe Acrobat Reader 8.1: If a user clicks on such a link
in a PDF, calc.exe is executed.
Miranda v0.7: If a user klicks on this link in a chat window, calc.exe is=
=20
executed
Netscape 7.1: mailto is handled by Netscape itself, but=20
similar telnet:-links start the calculator.
This list can propably be extended with little effort.
On a question to MSRC if Microsoft is planning to react on this, we=20
recieved the following response:
"After its thorough investigation, Microsoft has revealed that this is=20
not a vulnerability in a Microsoft product."=A0
For further information see:
http://www.heise-security.co.uk/news/96982
bye, ju
--=20
Juergen Schmidt editor-in-chief heise Security www.heisec.de
Heise Zeitschriften Verlag, Helstorferstr. 7, D-30625 Hannover
Tel. +49 511 5352 300 FAX +49 511 5352 417 EMail ju@heisec.de
GPG-Key: 0x38EA4970, 5D7B 476D 84D5 94FF E7C5 67BE F895 0A18 38EA 4970
--8323329-437043848-1191580876=:5461--