Got this today:
"I have created an example exploit on
http://www.xs4all.nl/~jkuperus/icq/icq.htm
that starts a little flame program
It works as followed
the default action for icq soundscheme (scm) files is open it places the wav files included with the scm file in a known location on the hard disk.
flame.scm wil be downloaded and installed in C:\Program Files\ICQ\Sounds\flame[1] the scm file i use creates a auth.wav file .
In reality however this is not a wav file but a mht (mail archive file) with en embeded base64 encoded executable
then i use one of the many available local code execution vulnerabilities found in internet explorer recently to execute the embedded binary with this url :
mhtml:file:///C:/Program%20Files/ICQ/Sounds/flame/Auth.wav!file:///C:/fire.exe
I dont think its necisary to use one of ie's exploit as you can also call html files in the mht archive, But for some reason i wasn't able to get this to work right away.
>>Workaround <<
For a short term solution
open explorer (the file manager not the browser)
go to the file types tab in tools > folder options
locate the scm extention and change the default behaviour to prompt before download
In the long term icq will have to use something like random foldernames for soundschemes to prefent this from happening"
"I have created an example exploit on
http://www.xs4all.nl/~jkuperus/icq/icq.htm
that starts a little flame program
It works as followed
the default action for icq soundscheme (scm) files is open it places the wav files included with the scm file in a known location on the hard disk.
flame.scm wil be downloaded and installed in C:\Program Files\ICQ\Sounds\flame[1] the scm file i use creates a auth.wav file .
In reality however this is not a wav file but a mht (mail archive file) with en embeded base64 encoded executable
then i use one of the many available local code execution vulnerabilities found in internet explorer recently to execute the embedded binary with this url :
mhtml:file:///C:/Program%20Files/ICQ/Sounds/flame/Auth.wav!file:///C:/fire.exe
I dont think its necisary to use one of ie's exploit as you can also call html files in the mht archive, But for some reason i wasn't able to get this to work right away.
>>Workaround <<
For a short term solution
open explorer (the file manager not the browser)
go to the file types tab in tools > folder options
locate the scm extention and change the default behaviour to prompt before download
In the long term icq will have to use something like random foldernames for soundschemes to prefent this from happening"
that idiots can allow for such stupid security flaws. Windows, ICQ, winamp, and any other program that sets its file associations to allow for auto download and auto run, are all to blame. All in the effort to make these programs easy for morons to install, because they can't remember where files go when they get downloaded.
Comment