[Full-disclosure] Phishing using IE7 local resource vulnerability
mattmurphy at kc.rr.com
Thu Mar 15 21:46:16 GMT 2007
On 3/15/07, avivra <avivra at gmail.com> wrote:
> Hi Robert,
> Protected Mode and UAC are different security features.
> But even though, it is possible to access local resource ("res://") links
> with Protected Mode and UAC features enabled. You can test it yourself here:
> http://www.raffon.net/research/ms/ie/navcancl/cnn.html or watch the demo
> video here: http://raffon.net/videos/ie7navcancl.wmv.
> The only way to mitigate this vulnerability by an out-of-the-box security
> feature is to set the security level of the "Internet Zone" to "High". This
> "Refresh the page." link in the navcancl.htm local resource page.
> But, I doubt anyone will do that when they can simply just avoid clicking
> any link in the "Navigation Canceled" page.
On XP SP2 (and probably Vista), you can block the exploitation of this
by disabling script execution for the res:// scheme specifically.
Note that I didn't try blocking the specific resource involved in the
If you attempt to add "res://*" or "res://ieframe.dll/navcancl.htm" to
the Restricted Sites zone, this results in an entry for
"about:internet" being added. After doing this, the "Refresh the
page" text is no longer a clickable link. Removing the
"about:internet" entry reverses the change. It seems that making this
change blocks scripts in ANY resource, even without the wildcard.
Full-Disclosure is hosted and sponsored by Secunia.