advisory#3
/--------------------------------------------------------------------/
Vendor: Microsoft Corp.
product: IE.6
test machine: winxp.pro.ed ,ie6 (FP)
Discovery by: Roozbeh Afrasiabi
(roozbeh_afrasiabi(At)yahoo(dot)com)
Risk: Low
Title: Showhelp() local CHM file execution
/--------------------------------------------------------------------/
TABLE OF CONTENTS:
==================
Description..............................................1
PoC......................................................2
Exploit..................................................3
Contact info.............................................4
Disclaimer...............................................5
1)Description:
==================
While previous patches were to stop showhelp from executing CHM files
using their path, a weakness in the way the double "\" is handled by
the its protocol handler allows for the execution of locally installed
CHM files.when "\\" is placed before the name of target CHM file the
HELP folder is searched for such name , if the help folder dose not
contain a file with that name then the rootdrive would be the next
path to be searched,when a file with that name is found in either of
these paths it would be executed .
2)POC
=========
POC
HTM help file opened in an iframe