This is a cryptographically signed message in MIME format.

--------------ms030805010702010805060201
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Microsoft Internet Explorer User Interface Race Condition

I. SYNOPSIS

Affected Systems:
  * Windows 98
  * Windows 98 Second Edition
  * Windows Millennium Edition
  * Windows 2000
  * Windows XP
  * Windows Server 2003

Risk:          Medium
Impact:        Remote code execution (some interaction required)
Status:        Uncoordinated release
Date Reported: October 20, 2005
Date Released: April 26, 2006
URL:
http://student.missouristate.edu/m/matthew007/advisories.asp?adv=2006-02
(delayed)
Author:        Matthew Murphy (mattmurphy@kc.rr.com)

II. EXECUTIVE SUMMARY

VULNERABILITY OVERVIEW

Microsoft Internet Explorer suffers from a potential user interaction
race in its handling of security dialogs.  As a result, it may be
possible for a malicious web site to install software on a visiting
system or take other actions that may compromise the privacy or the
security of the visitor.

IMPACT

A malicious web site, with a minimum of social engineering, may be
able to compromise user systems.

III. TECHNICAL DESCRIPTION

Microsoft Internet Explorer has an extremely sophisticated security
model based on content "zones", which controls the behavior of web
sites and how potentially unsafe content on them is handled.  The
browser reacts differently to potential security risks depending upon
what "zone" the content originates in.

The zone-based security model has had some serious security breaches,
many of which can be attributed to the previous use of the "Local
Machine Zone" to provide application-level functionality to web
content.

Most security settings in Internet Explorer allow one of three
settings for each zone:

    Enable
    Disable
    Prompt

Starting with Windows XP Service Pack 2 and Windows Server 2003
Service Pack 1, some prompting is now done via the "Information Bar"
feature.  Prior to these releases, most prompting is done via
modal dialogs.

Those dialogs that remain are vulnerable to an exploitable timing
condition that may result in unintended "Yes", "Allow" or "Install"
answer to a security prompt.  This situation is particularly serious
on Windows Server 2003 RTM, Windows XP Service Pack 1, Windows 2000,
and other older OSes, because prompting to allow ActiveX installation
is still done via a modal dialog on those systems.  On these systems,
successful exploitation of this condition allows software installation
as the logged on user.

On newer systems, the impact of this vulnerability is more limited,
but remains serious.  Many prompts continue to be delivered via modal
dialogs.  The most significant concern is that the default setting is
"Enable" in most of these cases, meaning that users could potentially
see their privacy compromised even if defaults had been significantly
tightened.

A malicious user could create content that would request the user to
click an object or press a sequence of keys.  By delivering a security
prompt during this process, the site could subvert the prompting and
obtain permission for actions that were not necessarily authorized.

IV. SUGGESTED ACTIONS

WORKAROUNDS

* Set security settings to "Enable" or "Disable" rather than "Prompt"

The vulnerability at issue depends fundamentally on a weakness in the
browser's method of prompting when warning users of potentially unsafe
active content on a web page.  By preemptively disabling certain
functionality that would otherwise generate warnings, the exploitation
of this vulnerability can be prevented or mitigated.

This functionality can be accessed from the "Tools" menu's "Internet
Options" button.  The "Security" tab of the dialog controls all of
these settings.  Such security configuration can also be enforced via
Group Policy.

IMPACT OF WORKAROUND: Disabling functionality where prompts would
otherwise have occurred may limit the functionality of certain web
pages that depend on potentially-dangerous active content such as
ActiveX controls.

MITIGATION RECOMMENDATIONS

* Limit viewing to trusted web sites

In some situations, browsing can be successfully limited to only
trustworthy sites without significant loss of productivity.  Users
should be extremely cautious while browsing unknown or untrusted web
sites, as such web sites are often able to introduce hostile code.

* Run exposed applications with reduced privileges

Users who log on interactively without the privileges of powerful
groups such as the "Administrators" or "Power Users" groups are at a
much lower risk of damage from successful exploitation of software
vulnerabilities in client applications.  This mitigation step greatly
reduces the likelihood of a successful malware installation if this
vulnerability is exploited.

V. VENDOR RESPONSE

* Microsoft was informed of this vulnerability on October 20, 2005.

* As part of its December patch cycle, Microsoft issued the incomplete
MS05-054 patch which plugged a specific instance of this issue that had
been previously reported by Secunia.

* MS05-054 does indeed provide minimal protection against subversion
of the download prompting feature, but makes no attempt to secure other
potential risk points.

* Contact with some members of the MSRC continued from the October
report beyond this point, but contact from the assigned investigator
did not take place until February 15, 2006.

* At that point in time, I was told that the vulnerability had been
classed as a "Service Pack" fix, meaning that users of Windows 2000 will
not receive a fix for this vulnerability.

* Further, the MSRC disputed my assessment that the vulnerability was
at all similar to CVE-2005-2289 (the File Download vulnerability patched
by MS05-054).

* Shortly after that decision, I informed MSRC that its assessment was
incorrect and also that I had tentatively planned to disclose on April
24.

* MSRC could not provide me with a compelling justification for its
choice of release timeframe.  In a rather threatening e-mail, I was
finally asked for exploit code, as well as justification of "why this
issue is so important".

* After about an hour of work to actually write it, I provided the code
to MSRC two days later on March 24.

* There is no further contact from MSRC following this point.

MSRC, for its troubles, got a two day reprieve because I was not yet
prepared to disclose.  So, I've (coincidentally) disclosed this issue in
keeping with Michal Zalewski's informal "Bug Wednesday and Patch
Saturday" policy.  My experience with MSRC shows that Zalewski's strong
objections to the generally-adversarial nature of the MSRC process and
its lack of constructive results (particularly when Internet Explorer
is involved) are well-founded.  Simply put, don't shoot the messenger
when your vendor and its patch processes are the problem most in need
of a solution.

VI. REFERENCES

SecurityTracker Alert ID#1015720
http://securitytracker.com/id?1015720

OSVDB ID#22351
http://www.osvdb.org/displayvuln.php?osvdb_id=22351

NOTE: If other VDBs could indicate what identifiers they have assigned
to this issue, that would be appreciated.  I will use such IDs for
reference points in the online version of this advisory to appear soon
after the release of this version.

VII. CREDIT

Jesse Ruderman reported similar attacks against Mozilla Firefox, and
provided the first research (that I am aware of) into user interface
bugs and security ramifications of them:

http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/

VIII. CONTACT

You may contact the author of this advisory via e-mail at
mattmurphy@kc.rr.com.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB5444D38

iD8DBQFET++Pfp4vUrVETTgRA8UHAJ48EwHO0QojXk9SF/O9byAW978uXACgopfx
HrdJmlblNk9Z1GglitxtvYg=
=pzQx
-----END PGP SIGNATURE-----

--------------ms030805010702010805060201
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIK7zCC
Az8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQI
EwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENv
bnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAi
BgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVy
c29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5
NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBM
dGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzAN
BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9Vvy
Gna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOC
dz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCB
kTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhh
d3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNV
HREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQAD
gYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFi
w9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpb
NU1341YheILcIRk13iSx0x1G/11fZU8wggPSMIIDO6ADAgECAhBmc+RYBq6y/B/JbFevcerA
MA0GCSqGSIb3DQEBBAUAMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3Vs
dGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz
dWluZyBDQTAeFw0wNjA0MTgyMzM5MzlaFw0wNzA0MTgyMzM5MzlaMIHBMR8wHQYDVQQDExZU
aGF3dGUgRnJlZW1haWwgTWVtYmVyMSMwIQYJKoZIhvcNAQkBFhRtYXR0bXVycGh5QGtjLnJy
LmNvbTErMCkGCSqGSIb3DQEJARYcTWF0dGhldzAwN0BNaXNzb3VyaVN0YXRlLmVkdTEmMCQG
CSqGSIb3DQEJARYXbWF0dG11cnBoeTUzMUBnbWFpbC5jb20xJDAiBgkqhkiG9w0BCQEWFW1h
dHRtdXJwaHk1MzFAbXNuLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALb2
fxOMZrjIgzxLHsKZJNBNQWgkmSZm1MQWzAiKxACTDIQW7AhL7/TNXZKj4KV7YIIwdMPtrJNE
RIfk8fIB5jaUJsAwvLYO3qKp34pSrpaRnNlnxxh5OWdibvgnp/wH0YLLOb6jSYm2ChnHEMtZ
W+DvKvy22pYvgvrApYduDVqWxx8FNsVNLF6+zmi77q6/sdokil8h2jtiLrLiq46OBsDBZx7H
wPcdRFa3OzuwZIiR6CuUjchrHdHyu0WolKQrS8nWRvZ+4j2H5tf6vNOaST+jfkFtjSlVQYlL
4Us6iJ6sglFw30sE/uPyVUA9BLrhAjFbW7IFFqNj93HPO+FihLcCAwEAAaOBpDCBoTAPBgNV
HQ8BAf8EBQMDB/mAMBEGCWCGSAGG+EIBAQQEAwIFoDBtBgNVHREEZjBkgRRtYXR0bXVycGh5
QGtjLnJyLmNvbYEcTWF0dGhldzAwN0BNaXNzb3VyaVN0YXRlLmVkdYEXbWF0dG11cnBoeTUz
MUBnbWFpbC5jb22BFW1hdHRtdXJwaHk1MzFAbXNuLmNvbTAMBgNVHRMBAf8EAjAAMA0GCSqG
SIb3DQEBBAUAA4GBACa2L1GAZYy3jYZJypiNA40e1Cv3hEBudujXhK348jBjW5+OApmjikPX
UWrbVi5I9hra64Q8oipLxRFnmjxSMFl+V3fS588QA09r6HNig4mdQj+jUxS5dvIbLhICq7Jw
DRrbU9deaYjHd23cd4nso3dFayyUu/AHtt+YU+XlXh9/MIID0jCCAzugAwIBAgIQZnPkWAau
svwfyWxXr3HqwDANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZy
ZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDYwNDE4MjMzOTM5WhcNMDcwNDE4MjMzOTM5WjCBwTEf
MB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEjMCEGCSqGSIb3DQEJARYUbWF0dG11
cnBoeUBrYy5yci5jb20xKzApBgkqhkiG9w0BCQEWHE1hdHRoZXcwMDdATWlzc291cmlTdGF0
ZS5lZHUxJjAkBgkqhkiG9w0BCQEWF21hdHRtdXJwaHk1MzFAZ21haWwuY29tMSQwIgYJKoZI
hvcNAQkBFhVtYXR0bXVycGh5NTMxQG1zbi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQC29n8TjGa4yIM8Sx7CmSTQTUFoJJkmZtTEFswIisQAkwyEFuwIS+/0zV2So+Cl
e2CCMHTD7ayTRESH5PHyAeY2lCbAMLy2Dt6iqd+KUq6WkZzZZ8cYeTlnYm74J6f8B9GCyzm+
o0mJtgoZxxDLWVvg7yr8ttqWL4L6wKWHbg1alscfBTbFTSxevs5ou+6uv7HaJIpfIdo7Yi6y
4quOjgbAwWcex8D3HURWtzs7sGSIkegrlI3Iax3R8rtFqJSkK0vJ1kb2fuI9h+bX+rzTmkk/
o35BbY0pVUGJS+FLOoierIJRcN9LBP7j8lVAPQS64QIxW1uyBRajY/dxzzvhYoS3AgMBAAGj
gaQwgaEwDwYDVR0PAQH/BAUDAwf5gDARBglghkgBhvhCAQEEBAMCBaAwbQYDVR0RBGYwZIEU
bWF0dG11cnBoeUBrYy5yci5jb22BHE1hdHRoZXcwMDdATWlzc291cmlTdGF0ZS5lZHWBF21h
dHRtdXJwaHk1MzFAZ21haWwuY29tgRVtYXR0bXVycGh5NTMxQG1zbi5jb20wDAYDVR0TAQH/
BAIwADANBgkqhkiG9w0BAQQFAAOBgQAmti9RgGWMt42GScqYjQONHtQr94RAbnbo14St+PIw
Y1ufjgKZo4pD11Fq21YuSPYa2uuEPKIqS8URZ5o8UjBZfld30ufPEANPa+hzYoOJnUI/o1MU
uXbyGy4SAquycA0a21PXXmmIx3dt3HeJ7KN3RWsslLvwB7bfmFPl5V4ffzGCA2QwggNgAgEB
MHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0
ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhBmc+RY
Bq6y/B/JbFevcerAMAkGBSsOAwIaBQCgggHDMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
HAYJKoZIhvcNAQkFMQ8XDTA2MDQyNjIyMDkxOVowIwYJKoZIhvcNAQkEMRYEFIH5yCE4IZMQ
g793X2amYUyGZ6KAMFIGCSqGSIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwIC
AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGFBgkrBgEEAYI3
EAQxeDB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5
KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIQ
ZnPkWAausvwfyWxXr3HqwDCBhwYLKoZIhvcNAQkQAgsxeKB2MGIxCzAJBgNVBAYTAlpBMSUw
IwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUg
UGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIQZnPkWAausvwfyWxXr3HqwDANBgkqhkiG
9w0BAQEFAASCAQAMYE8mB441mx10GSfKONWvDAMTG7o4+ZC7eqPgtU+uijvP8B8DZCIrd9Tf
j9KN3IP9Is+uLZWDqC1AG3RdKLCzTrl7K9HQOiiAPlfwnQtbt8W15Ek/ZIRdQigssMyMFHP/
SiyPHEhUq4f9nzClLYlvv7BNGTB43fFRbK2YkmsR/6/NO77rFDEEIbg4TLzUqqlOpDRKp7Io
O0w3X41/iZbOrFBcu1+yY/rHPKPtk7Fi3Fkf88/qUpJX47VZj+D7RhDE6lWK2DW/96WodWS1
QXDXCEEdWYQlSvRmDJ/zCv4snpsNhRQgSQfwj12GXrZfUvfNP4gxNifCPb/fvRXP6qcfAAAA
AAAA
--------------ms030805010702010805060201--