«
»
 

Vulnerabilitate MHTML – Microsoft Windows

| February 1st, 2011

Virus Desinfection

Microsoft a anuntat pe 28.01.2011 ca a descoperit o vulnerabilitate in toate editiile Microsoft Windows (Microsoft Windows XP SP2 si SP3, Windows Server 2003 SP2, Windows Vista SP1 si SP2, Windows Server 2008 Gold, SP2 si R2 precum si Windows 7). Implementarea MHTML (MIME Encapsulation of Aggregate HTML Documents) din produsele Microsoft Windows nu trateaza in mod corespunzator formatul MIME (Multipurpose Internet Mail Extensions) intr-o cerere pentru blocuri de continut dintr-un document, lucru care ii permite unui atacator sa conduca atacuri de tip cross-site scripting (XSS) prin browser-ul Internet Explorer.

Microsoft nu a inlaturat amenintarea din sistem, insa a lansat un patch pentru a o bloca. Toti utilizatorii Windows, in special cei care folosesc Internet Explorer, sunt sfatuiti sa descarce si sa instaleze patch-ul, pana cand echipa de securitate a companiei va gasi o cale de rezolvare a problemei. O alta varianta, asa cum recomanda secunia.com, este blocarea manuala a protocolului MHTML.

Article ID: 2501696 – Last Review: January 28, 2011 – Revision: 1.0
Microsoft Security Advisory: Vulnerability in MHTML could allow information disclosure
http://support.microsoft.com/kb/2501696

Cum pot sa testez ca sunt protejat impotriva vulnerabilitatii?

Pasul 1: Creati un fisier test.mht, cu urmatorul cuprins:

From: "Test"
Subject: 
Date: Mon, 1 Jan 1111 11:11:11 -0800
MIME-Version: 1.0
Content-Type: text/html;
       charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-MimeOLE: Produced By Microsoft MimeOLE V6.1.7600.16543

=EF=BB=BF<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Dutf-8" http-equiv=3DContent-Type>
<SCRIPT>
function foo()
{
alert("hello");
}
</SCRIPT>
<META name=3DGENERATOR content=3D"MSHTML 8.00.7600.16700"></HEAD>
<BODY onload=3Dfoo()>test MHTML protocol </BODY></HTML>

Pasul 2: Incarcati fisierul test.mht pe un server web.
Inainte de a aplica solutia, atunci cand navigati catre link-ul incarcat, urmatorul ecran apare:

Asa cum se vede, script-ul din interiorul fisierului MHTML se executa cu “succes”.

Dupa aplicarea workaround-ului si repornirea IE, scriptul devine inactiv si urmatorul ecran apare:

Bara de avertizare indica faptul ca protocolul MHTML este blocat iar script-ului nu ii este permis sa ruleze.

Surse:
http://support.microsoft.com/kb/2501696
http://www.microsoft.com/technet/security/advisory/2501696.mspx
http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx
http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx
http://secunia.com/advisories/43093

Posted on Tuesday, February 1st, 2011 at 5:44 pm in Errors, Internet, Script, Update | rss feed for comments| Both comments and pings are currently closed.

Comments are closed.