SP2 execCommand 'SaveAs' Vuln.

[Redhat]

Circumvent Windows XP SP2 Security Features using execCommand 'SaveAs'

Function

------------------------------------------------------------------------

SUMMARY

Microsoft Internet Explorer (including IE for Windows XP SP2) is reported to be vulnerable to a file downloading security warning bypass. This unpatched flaw may be exploited to download a malicious executable file masqueraded as an HTML file.

DETAILS

Vulnerable Systems:

* Internet Explorer version 6

When your browser cannot locate the URL that you entered in the address bar, you will receive a 404 error message telling you that the file was not found. This exploit described below utilizes a custom HTTP 404 error message (v.exe) which is feed to the execCommand Method, which in turn executes the file (without warning). The only user input required is for the user to accept a prompts requesting him to "Save an HTML Document".

1. Bypasses the "File Download - Security Warning".

Each time you click a download link, Windows XP pops up a "File Download - Security Warning", making you aware that Windows is downloading a program.

In addition Windows XP will ask for your permission to complete the download process.

2. Bypasses the "Open File - Security Warning".

Launching a downloaded executable that originates from an untrusted location (zone) such as the Internet will bring up a "Open File - Security Warning" that will ask you for the permission to install the file.

The execCommand Method:

The execCommand method executes a command on the current document. One of the many parameters of this method is the SaveAs Command that saves the current Web page to a local file. The SaveAs Command has the following

format: document.execCommand('SaveAs', '1', 'Name of the webpage.htm');

More info : » http://www.k-otik.com/exploits/20041119.IESP2..

I originally got this on the securiteam mailing list.