Vulnerability Note VU#711843

Microsoft Internet Explorer contains cross-site scripting vulnerabilities in local HTML resources

In VU#728563, IE fails to correctly identify the source of modal dialog frames opened with the Redirect method or IFRAME elements. In VU#711843, local HTML resources accept script from modal dialog frames via the dialogArguments property. As a result, script from an attacker's web page can be injected into local HTML resources and the script will execute in the Local Machine Zone.

The following local HTML resources in IE 6.0 are vulnerable:

res://shdoclc.dll/privacypolicy.dlg
res://shdoclc.dll/{policyerror.htm,policylooking.htm,policynone.htm,policysyntaxerror.htm}

res://shdoclc.dll/analyze.dlg

Apply 810847 or a more recent cumulative patch. See Microsoft Security Bulletin MS03-004 for more information.

Disable Active scripting

Active scripting is required to open a modal dialog frame and populate dialogArguments, which is a proven and well-publicized method of attack. At a minimum, disable Active scripting in the Internet zone and the zone used by Outlook, Outlook Express, or any other email client that uses Internet Explorer or the WebBrowser control to render HTML. Instructions for disabling Active scripting can be found in the CERT/CC Malicious Web Scripts FAQ.

Apply the Outlook Email Security Update

Another way to effectively disable Active scripting in Outlook is to install the Outlook Email Security Update. The update configures Outlook to open email messages in the Restricted Sites Zone, where Active scripting is disabled by default. In addition, the update provides further protection against malicious code that attempts to propagate via Outlook. The Outlook Email Security Update is available for Outlook 98 and Outlook 2000. The functionality of the Outlook Email Security Update is included in Outlook 2002 and Outlook Express 6.

Update HTML Help

To protect against arbitrary command execution, install an updated version of HTML Help (811630). As described in Microsoft Security Bulletin MS03-015, the updated HHCtrl ActiveX control disables the Shortcut command in a compiled help file that has been opened with the showHelp method:

• Only supported protocols [http:, https:, file:, ftp:, ms-its:, or mk:@MSITStore:] can be used with showHelp to open a web page or help (chm) file.
• The shortcut function supported by HTML Help will be disabled when the help file is opened with showHelp This will not affect the shortcut functionality if the same CHM file is opened by the user manually by double-clicking on the help file, or by through an application on the local system using the HTMLHELP( ) API.

http://www.pivx.com/larholm/adv/TL002/default.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0189
http://www.microsoft.com/technet/security/bulletin/MS02-023.asp
http://online.securityfocus.com/bid/4527
http://security.greymagic.com/adv/gm001-ax/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0691
http://microsoft.com/technet/security/bulletin/MS02-047.asp
http://online.securityfocus.com/bid/5561
http://www.iss.net/security_center/static/9938.php
http://www16.brinkster.com/liudieyu/BadParent/BadParent-CONTENT.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1326
http://microsoft.com/technet/security/bulletin/MS03-004.asp
http://www.securityfocus.com/bid/6205
http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/showmodaldialog.asp
http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/showmodelessdialog.asp
http://msdn.microsoft.com/workshop/author/om/doc_object.asp
http://msdn.microsoft.com/workshop/author/om/windows_frames_dialogs.asp
http://msdn.microsoft.com/workshop/author/om/windows_frames_dialogs.asp#sec_dialogs
http://msdn.microsoft.com/workshop/author/dhtml/reference/properties/dialogarguments.asp
http://msdn.microsoft.com/workshop/security/szone/overview/overview.asp#default_zones
http://support.microsoft.com/support/kb/articles/Q182/5/69.ASP
http://msdn.microsoft.com/workshop/browser/webbrowser/browser_control_ovw_entry.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemwebhttpresponseclassredirecttopic.asp
http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/iframe.asp
http://msdn.microsoft.com/workshop/author/om/xframe_scripting_security.asp
http://msdn.microsoft.com/workshop/author/dhtml/sec_dhtml.asp

Credit

This vulnerability was publicly reported by Thor Larholm.

This document was written by Art Manion and Shawn Van Ittersum.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.