bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Another security hole in Internet Explorer

Summary

In January 2004 the security researcher “http-equiv” documented a hole in Internet Explorer on Full Disclosure through which files with fake extensions could be slipped to users. The browser did not check fake CLASSIDs, so that, for example, an HTML file disguised as a PDF was executed as HTML when opened. There was no patch yet; the only protection was to save files locally first.

Ideas

  • File extension and actual file type can differ.
  • The browser trusted a supplied class identifier instead of the content.
  • Automatically opening PDFs in the browser concealed the process.
  • Windows Explorer recognised the fake when the file was opened locally.

Insights

  • Decisions based on file extensions are a recurring point of entry.
  • Automatic convenience functions take away users’ chance to notice anything suspicious.

Facts

  • The pattern resembled a folder bug in Windows XP that had become known shortly before.
  • Microsoft offered no patch at the time of the report.

References

Critique

  • The recommended workaround of saving locally requires knowledge that average users hardly have.

Recommendations

  • Have file types checked by content rather than by extension, for example with file or protection against MIME sniffing.
  • Disable automatic opening of downloaded files in the browser.

Read the original article

Search the Web Archive

g · 2002

Internet Explorer has a security hole in JavaScript

In January 2002 the Bulgarian security researcher Georgi Guninski published a hole in Internet Explorer through which JavaScript could read local files and start programs. The cause was an incorrect interpretation of the GetObject() function; the patched IE 6.0 and IE 5.5 SP2 under Windows 2000 were affected. According to Guninski, Microsoft had been informed three weeks earlier and had not responded.

g · 2010

Exploits for IE security hole circulate on the internet

In January 2010 exploits were circulating for the Internet Explorer hole through which attackers had previously attacked Google and other companies. According to The Register, both Metasploit and Immunity Canvas had the code, which allowed control of the computer through an invalid pointer access. In tests it worked in IE 6 and 7 under Windows XP SP3, while IE 8 initially only crashed.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.